Advisories · Technology
CodeWithCJ SparkyFitness.
Every CVE that names CodeWithCJ SparkyFitness among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint
- CodeWithCJ SparkyFitness
- Broken access control
- CVSS 5.4 Medium
SparkyFitness: SSRF via unvalidated custom_url in AI service settings
- CodeWithCJ SparkyFitness
- Server-side request forgery (SSRF)
- CVSS 7.2 High
SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore
- CodeWithCJ SparkyFitness
- Command injection