CVE-2026-86254: Missing Authorization

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the issamegym helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user...

BIT-JOOMLA-2024-40749 [20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

CVE-2024-40749 [20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

CVE-2024-40749 [20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

CVE-2024-40749

The Joomla! content management system is vulnerable to an Improper Access Control flaw in multiple core views . This vulnerability, identified as a Read ACL violation , allows unauthorized access to protected views. The issue affects several versions, including Joomla! 3.x prior to 3.10.20 , 4.x ...

[20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

CVE-2023-38759

Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...

CVE-2023-38759

Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...

CVE-2023-38759: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...

CVE-2023-38759

CVE-2023-38759 describes a Cross-Site Request Forgery (CSRF) vulnerability in the wger Project, Workout Manager version 2.2.0a3. The issue enables a remote attacker to gain privileges via the user-management features, affecting multiple components/files (e.g., gym.py, reset_user_password.html, ov...

CVE-2019-14679: Cross-Site Request Forgery (CSRF)

core/views/arpriceimportexport.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arpliteimportexport CSRF...

[20201107] - Core - Write ACL violation in multiple core views

Lack of input validation while handling ACL rulesets can cause write ACL violations...

PT-2017-18270

Name of the Vulnerable Software and Affected Versions Mura CMS version 7.0.6967 Description The issue allows for XSS attacks, related to several files including admin/core/views/carch/list.cfm, admin/core/views/carch/loadsiteflat.cfm, admin/core/views/cusers/inc/dsp nextn.cfm,...