Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management via UserDeactivateView and UserActivateView in wger/core/views/user.py, where WgerMultiplePermissionRequiredMixin applies OR logic to the permissionrequired tuple, granting any user holding the gym.gymtrain...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration via the authentication lifecycle in wger/core/views/user.py and the API token management in wger/utils/apitoken.py, where bearer-style API credentials are not revoked on logout or password change. The...

CVE-2026-86256

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86254

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the issamegym helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user...

CVE-2026-86254: Missing Authorization

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the issamegym helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user...

BIT-JOOMLA-2024-40749 [20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

CVE-2024-40749 [20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

CVE-2024-40749 [20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

CVE-2024-40749

The Joomla! content management system is vulnerable to an Improper Access Control flaw in multiple core views . This vulnerability, identified as a Read ACL violation , allows unauthorized access to protected views. The issue affects several versions, including Joomla! 3.x prior to 3.10.20 , 4.x ...

[20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

CVE-2023-38759

Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...

CVE-2023-38759

Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...

CVE-2023-38759

CVE-2023-38759 describes a Cross-Site Request Forgery (CSRF) vulnerability in the wger Project, Workout Manager version 2.2.0a3. The issue enables a remote attacker to gain privileges via the user-management features, affecting multiple components/files (e.g., gym.py, reset_user_password.html, ov...

CVE-2023-38759: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/resetuserpassword.html, templates/user/overview.html, core/views/user.py, and...

CVE-2019-14679: Cross-Site Request Forgery (CSRF)

core/views/arpriceimportexport.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arpliteimportexport CSRF...

[20201107] - Core - Write ACL violation in multiple core views

Lack of input validation while handling ACL rulesets can cause write ACL violations...

PT-2017-18270

Name of the Vulnerable Software and Affected Versions Mura CMS version 7.0.6967 Description The issue allows for XSS attacks, related to several files including admin/core/views/carch/list.cfm, admin/core/views/carch/loadsiteflat.cfm, admin/core/views/cusers/inc/dsp nextn.cfm,...