Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

wger

19 known vulnerabilities (1 critical, 7 high, 8 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
2.1.0 (Oct 11, 2022): affected by 19 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
19 · 1 critical, 7 high, 8 medium, 1 low
Weekly downloads
60
Dependents
0
Releases
14 since 1.1.0 (Feb 23, 2013)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 19 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 19

  • CVE-2026-46438Medium 6.5

    wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

    Affected: through 2.1.

    No fix released. The latest release, 2.1.0, is still affected.

  • CVE-2026-46437Medium 4.8

    wger: API credentials remain valid after logout/password change

    Affected: through 2.1.

    No fix released. The latest release, 2.1.0, is still affected.

  • wger: Trainer Privilege Escalation - Improper Privilege Management

    Affected: through 2.1.

    No fix released. The latest release, 2.1.0, is still affected.

  • CVE-2026-45161Medium 5.4

    wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding

    Affected: through 2.1.

    No fix released. The latest release, 2.1.0, is still affected.

  • wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

    Affected: through 2.1.

    No fix released. The latest release, 2.1.0, is still affected.

  • CVE-2026-86257Medium 4.8

    wger before 2.6 CSV Formula Injection via member export

    Affected: fixed in 2.6.

    No fix released. The advisory names 2.6 as the fix, which the registry doesn't have yet. The latest release, 2.1.0, is still affected.

  • CVE-2026-86256Medium 5.1

    wger before 2.6 Open Redirect via trainer-login next parameter

    Affected: fixed in 2.6.

    No fix released. The advisory names 2.6 as the fix, which the registry doesn't have yet. The latest release, 2.1.0, is still affected.

  • wger before 2.5 Uncontrolled Resource Consumption via date_sequence

    Affected: through 2.5.

    No fix released. The latest release, 2.1.0, is still affected.

  • wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API

    Affected: through 2.5.

    No fix released. The latest release, 2.1.0, is still affected.

  • wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers

    Affected: through 2.5.

    No fix released. The latest release, 2.1.0, is still affected.

  • CVE-2026-43948Critical 9.9

    wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

    Affected: fixed in 2.6.

    No fix released. The advisory names 2.6 as the fix, which the registry doesn't have yet. The latest release, 2.1.0, is still affected.

  • wger has Broken Access Control in the Global Gym Configuration Update Endpoint

    Affected: through 2.1.

    No fix released. The latest release, 2.1.0, is still affected.

  • CVE-2026-40353Medium 5.1

    wger: Stored XSS via Unescaped License Attribution Fields

    Affected: through 2.4.

    No fix released. The latest release, 2.1.0, is still affected.

  • CVE-2026-27839Medium 4.3

    wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup

    Affected: through 2.1.

    No fix released. The latest release, 2.1.0, is still affected.

  • wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data

    Affected: through 2.1.

    No fix released. The latest release, 2.1.0, is still affected.

Show all 19 advisoriesShow fewer advisories
  • CVE-2026-27835Medium 4.3

    wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data

    Affected: through 2.1.

    No fix released. The latest release, 2.1.0, is still affected.

  • Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges…

    Affected: through 2.2.0a3; all versions.

    No fix released. The latest release, 2.1.0, is still affected.

  • Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the…

    Affected: all versions; through 2.2.0a3.

    No fix released. The latest release, 2.1.0, is still affected.

  • Improper Restriction of Excessive Authentication Attempts in wger-project/wger

    Affected: fixed in 2.2.

    No fix released. The advisory names 2.2 as the fix, which the registry doesn't have yet. The latest release, 2.1.0, is still affected.