Vendor
wger Improper Privilege Management
1 rule 1 TTP 1 CVEA privilege escalation vulnerability in wger allows gym trainers to deactivate higher-privileged accounts, resulting in administrative lockout.
wger IDOR Vulnerability Exposes Private Workout Data (CVE-2026-43977)
2 rules 1 TTPwger 2.5 and earlier is vulnerable to CVE-2026-43977, an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to read another user's private workout session notes, exercise history, and training statistics by accessing the `/logs/` and `/stats/` actions on a public template routine they do not own.
wger Cross-Tenant Password Reset and Plaintext Disclosure Vulnerability
2 rules 1 TTPA vulnerability in wger version 2.5 and earlier allows an attacker with `gym.manage_gym` permission and `gym=None` to reset the password of any other `gym=None` user, disclosing the new password in plaintext and allowing account takeover.
wger CSV/TSV Formula Injection Vulnerability
2 rules 1 TTP 3 IOCsA CSV/TSV injection vulnerability exists in wger <= 2.5, allowing malicious gym members to inject spreadsheet formulas into their profiles, which are then executed when an administrator exports and opens the member list, potentially leading to data exfiltration and remote code execution.