Wger-Project
7 CVEs across 2 Wger-Project products. Browse Wger-Project vulnerabilities, severities, and proof-of-concept exploits.
Wger-Project products with known CVEs
Wger-Project CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-43978 | High | 8.1 | 2026-07-16 | wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (g… |
CVE-2026-43977 | High | 7.5 | 2026-07-16 | wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes… |
CVE-2026-43948 | Critical | 9.9 | 2026-05-12 | wger is a free, open-source workout and fitness manager. Prior to 2.6, the reset_user_password and gym_permissions_user_edit views in wger perform a gym-scope… |
CVE-2026-40474 | High | 7.6 | 2026-04-17 | wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymco… |
CVE-2026-40353 | Medium | 5.4 | 2026-04-17 | wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the attribution_link property in AbstractLicenseModel constructs HTML by di… |
CVE-2026-27839 | Medium | 4.3 | 2026-02-26 | wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Mo… |
CVE-2026-27838 | Low | 3.1 | 2026-02-26 | wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up… |
CVE-2026-27835 | Medium | 4.3 | 2026-02-26 | wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` retu… |
CVE-2022-2650 | Critical | 9.8 | 2022-11-24 | Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2. |