Rezultati pretraživanja za 'Proizvođač: wger'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-40474 | 7.6 | wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never | 2026-04-24 14:46:22 | 2026-04-17 22:16:33 |
| CVE-2026-40353 | 5.4 | wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by directly interpolating user-controlled license fields (such as license_author) without escapi | 2026-04-24 14:46:04 | 2026-04-17 22:16:33 |
| CVE-2026-27835 | 4.3 | wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` return all users' repetition config data because their `get_queryset()` calls `.all()` instead | 2026-03-03 20:01:10 | 2026-02-26 22:20:49 |
| CVE-2026-27838 | 3.1 | wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up to and including 2.4, ache keys are scoped only by `pk` — no user ID is included. When a vi | 2026-03-03 00:50:54 | 2026-02-26 23:16:34 |
| CVE-2026-27839 | 4.3 | wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Model.objects.get(pk=pk)` — a raw ORM call that bypasses the user-scoped queryset. Any authen | 2026-03-03 00:49:06 | 2026-02-26 23:16:35 |
| CVE-2022-2650 | 9.8 | Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2. | 2022-11-30 15:48:00 | 2022-11-24 17:15:00 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/1
Zapisa po stranici: