pypi

wger

36 Total advisories

36 Vulnerabilities

0 Malware

Dependency scanning

Check whether wger is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

wger

Vulnerabilities

wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager

wger: Trainer Privilege Escalation - Improper Privilege Management

wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding

wger: API credentials remain valid after logout/password change

wger: API credentials remain valid after logout/password change

wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

wger: Trainer Privilege Escalation - Improper Privilege Management

wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding

wger: CSV/TSV formula injection in gym member export (first_name/last_name)

wger: trainer_login open redirect - ?next= parameter not validated against host

wger has an Uncontrolled Resource Consumption issue

wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup

wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data

wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API

wger has Broken Access Control in Global Gym Configuration Update Endpoint

wger has Stored XSS via Unescaped License Attribution Fields

wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data

wger has Broken Access Control in Global Gym Configuration Update Endpoint

wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data

wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API

wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data

wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup

wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager

wger has Stored XSS via Unescaped License Attribution Fields

wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

wger vulnerable to brute force attempts

wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

wger vulnerable to brute force attempts

CVE-2023-38759

CVE-2023-38758

wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None

wger Workout Manager Cross-Site Request Forgery vulnerability

wger Workout Manager Cross-site Scripting vulnerability

Browse more PyPI advisories

Start Securing