CVE-2026-46438

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's "SlotEntry" by supplying the victim's "slotentry" ID in a "POST /api/v2/workoutlog/" request. The "slotentry" foreign key is not...

CVE-2026-46438: Authorization Bypass Through User-Controlled Key

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

Fitness Workout Log Diary - Customized SSL, Redefined SSL Common Names verifier, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Fitness Workout Log Diary published at the 'play' market has multiple vulnerabilities...

Easy Workout Log - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Easy Workout Log published at the 'play' market has multiple vulnerabilities...