Vendor
wger-project
19 known vulnerabilities.
wger-project at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 5 | 0 |
| Sep 2026 | 4 | 0 |
| Aug 2026 | 1 | 0 |
| Jul 2026 | 2 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 1 | 1 |
| Apr 2026 | 2 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 3 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
19 results · Feed
-
Medium 6.5
wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry
wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` reque…
-
Medium 4.8
wger: API credentials remain valid after logout/password change
wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability in the authentication/session lifecycle of `wger` where bearer-style API credentials remain valid after a user logs out and after a user changes their password…
-
High 7.1
wger: Trainer Privilege Escalation - Improper Privilege Management
wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grant…
-
Medium 5.4
wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes `django_login()` without any CSRF protection, because Django's `CsrfViewMiddleware` only enforces tokens on unsaf…
-
High 7.1
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.ad…
-
Medium 5.4
wger before 2.6 Open Redirect via trainer-login next parameter
wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseR…
-
Medium 5.4
wger before 2.6 CSV Formula Injection via member export
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins…
-
Medium 6.5
wger before 2.5 Uncontrolled Resource Consumption via date_sequence
wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the ser…
-
Medium 6.8
wger Incomplete Authorization Fix Cross-Tenant Account Deletion
wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is_same_gym() helper, allowing gym staff with gym=None to dele…
-
Medium 4.3
wger-project wger Password Reset gym.py reset_user_password cross-site request forgery
A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possib…
-
High 7.5
wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine t…
-
High 8.1
wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer per…
-
Critical 9.9
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
wger is a free, open-source workout and fitness manager. Prior to 2.6, the reset_user_password and gym_permissions_user_edit views in wger perform a gym-scope authorization check using Python object comparison (!=) that evaluates None != None as False, silent…
-
High 7.6
wger has Broken Access Control in the Global Gym Configuration Update Endpoint
wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced…
-
Medium 5.1
wger: Stored XSS via Unescaped License Attribution Fields
wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by directly interpolating user-controlled license fields (such as license_author) without escaping, and t…
-
Medium 4.3
wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Model.objects.get(pk=pk)` — a raw ORM call that bypasses the user-scoped queryset. Any authenticated u…
-
Low 3.1
wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data
wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up to and including 2.4, ache keys are scoped only by `pk` — no user ID is included. When a victim has …
-
Medium 4.3
wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data
wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` return all users' repetition config data because their `get_queryset()` calls `.all()` instead of filter…
-
High 7.8CVE-2022-2650 Public exploit
Improper Restriction of Excessive Authentication Attempts in wger-project/wger
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.