PYSEC-2026-4313 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

Summary Five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment gym=None can read private admin notes, uploaded documents, gym contracts...

GHSA-C72H-82W6-RQFP wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

Summary Five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment gym=None can read private admin notes, uploaded documents, gym contracts...

wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

Summary Five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment gym=None can read private admin notes, uploaded documents, gym contracts...

CVE-2026-43976

The wger fitness manager is vulnerable to a cross-tenant data leak in versions prior to 2.6 . A flaw in the gym-scope guard (gym_a != gym_b) allows it to silently pass when both operands are None. Consequently, a trainer with gym.gym_trainer and gym.add_adminusernote permissions but no gym assign...

CVE-2026-43976 wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard gyma != gymb that silently passes when both operands are None. A trainer with gym.gymtrainer and gym.addadminusernote permissions and no gym assignment...

CVE-2022-0211

The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

Exploit for SQL Injection in Djangoproject Django

CTF Challenge: Django ORM Injection CVE-2025-64459 Catego...

EUVD-2018-3135

Malware in sbrugna...

EUVD-2022-15413

Malicious code in bioql PyPI...

EUVD-2025-28159

Malicious code in bioql PyPI...

EUVD-2025-17150

Malicious code in bioql PyPI...

EUVD-2023-12531

Malicious code in bioql PyPI...

CVE-2025-9228 Insufficient authorization when creating notes

MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes which are intended only for administrative users...

CVE-2025-9228 Insufficient authorization when creating notes

MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes which are intended only for administrative users...

CVE-2025-9228

MiR software (versions prior to 3.0.0) has insufficient authorization controls when creating text notes, allowing low-privilege users to create notes intended for administrators. Root cause: authorization gap in text-note creation. Impact: potential integrity concerns within text notes; CVSS-A/I ...

Mobile Industrial Robots MiR Robots security vulnerabilities

Mobile Industrial Robots MiR Robots is an autonomous mobile robot from Mobile Industrial Robots, Denmark. A security vulnerability exists in Mobile Industrial Robots MiR Robots versions prior to 3.0.0, which stems from insufficient authorization controls and could allow a low-privileged user to...

PT-2025-34027

Name of the Vulnerable Software and Affected Versions: MiR software versions prior to 3.0.0 Description: MiR software versions prior to 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes intended only for administrative users...

CVE-2025-49446

Cross-Site Request Forgery CSRF vulnerability in minhlaobao Admin Notes admin-note allows Cross Site Request Forgery.This issue affects Admin Notes: from n/a through = 1.1...

CVE-2025-49446

Cross-Site Request Forgery CSRF vulnerability in minhlaobao Admin Notes admin-note allows Cross Site Request Forgery.This issue affects Admin Notes: from n/a through = 1.1...

CVE-2025-49446 WordPress Admin Notes plugin <=1.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in minhlaobao Admin Notes admin-note allows Cross Site Request Forgery.This issue affects Admin Notes: from n/a through = 1.1...