PkgSeer

Vulnerabilities

Last updated 2 hours ago
Filters
Severity
Critical Severity
CVSS Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
High Severity
CVSS Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
Medium Severity
CVSS Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
Low Severity
CVSS Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
Unknown Severity
CVSS Score Range: No score
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
Package Summary Severity Published Modified
wger wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager High Risk 8.1 5 months ago 8 hours ago
wger wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views) High Risk 7.1 29 days ago 10 days ago
wger wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry Medium Risk 6.5 29 days ago 10 days ago
wger wger: Trainer Privilege Escalation - Improper Privilege Management High Risk 7.1 29 days ago 10 days ago
wger wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding Medium Risk 5.4 29 days ago 21 days ago
wger wger: API credentials remain valid after logout/password change Medium Risk 4.8 29 days ago 21 days ago
wger wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views) High Risk 7.1 21 days ago 21 days ago
wger wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry Medium Risk 6.5 21 days ago 21 days ago
wger wger: API credentials remain valid after logout/password change Medium Risk 4.8 21 days ago 21 days ago
wger wger: Trainer Privilege Escalation - Improper Privilege Management High Risk 7.1 21 days ago 21 days ago
wger wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding Medium Risk 5.4 21 days ago 21 days ago
wger wger: trainer_login open redirect - ?next= parameter not validated against host Medium Risk 5.4 6 months ago 1 month ago
wger wger: CSV/TSV formula injection in gym member export (first_name/last_name) High Risk 7.4 6 months ago 1 month ago
wger wger has an Uncontrolled Resource Consumption issue Medium Risk 6.5 5 months ago 1 month ago
wger wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup Medium Risk 4.3 8 months ago 3 months ago
wger wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data Low Risk 3.1 8 months ago 3 months ago
wger wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API High Risk 7.5 5 months ago 3 months ago
wger wger has Broken Access Control in Global Gym Configuration Update Endpoint High Risk 7.6 6 months ago 3 months ago
wger wger has Stored XSS via Unescaped License Attribution Fields Medium Risk 5.4 6 months ago 3 months ago
wger wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data Medium Risk 4.3 8 months ago 3 months ago
wger wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data Medium Risk 4.3 3 months ago 3 months ago
wger wger has Broken Access Control in Global Gym Configuration Update Endpoint High Risk 7.6 3 months ago 3 months ago
wger wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data Low Risk 3.1 3 months ago 3 months ago
wger wger has Stored XSS via Unescaped License Attribution Fields Medium Risk 5.4 3 months ago 3 months ago
wger wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager High Risk 8.1 3 months ago 3 months ago
wger wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API High Risk 7.5 3 months ago 3 months ago
wger wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup Medium Risk 4.3 3 months ago 3 months ago
wger wger: cross-tenant password reset and plaintext disclosure via gym=None bypass Critical 9.9 4 months ago 3 months ago
wger wger vulnerable to brute force attempts Critical 9.8 4 months ago 4 months ago
wger wger: cross-tenant password reset and plaintext disclosure via gym=None bypass Critical 9.9 6 months ago 4 months ago
wger wger vulnerable to brute force attempts Critical 9.8 3 years ago 4 months ago
wger No summary available Medium Risk 5.4 3 years ago 4 months ago
wger No summary available High Risk 8.8 3 years ago 4 months ago
wger wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None High Risk 8.5 5 months ago 5 months ago
wger wger Workout Manager Cross-Site Request Forgery vulnerability High Risk 8.8 3 years ago 1 year ago
wger wger Workout Manager Cross-site Scripting vulnerability Medium Risk 5.4 3 years ago 1 year ago
Data courtesy of OSV.dev
Page 1