CVE-2026-102923 SparkyFitness: SSRF via unvalidated custom_url in AI service settings

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a...

CVE-2026-102923

Prior to version 1.6.0 , the SparkyFitness health and fitness tracker is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists because the components SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts fail to validate destinations provide...

CVE-2024-5439

The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the customurl parameter in all versions up to, and including, 2.0.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVE-2024-5439: Improper Input Validation

The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the customurl parameter in all versions up to, and including, 2.0.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...