Refine your search

3 vulnerabilities found for by CodeWithCJ

CVE-2026-113612 (GCVE-0-2026-113612)
Vulnerability from cvelistv5
Published
2026-10-20 15:40
Modified
2026-10-20 16:25
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE
Summary
SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.
References
Impacted products
Vendor Product Version
CodeWithCJ SparkyFitness Version: 0   < 0.17.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113612",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T16:24:11.606376Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T16:25:31.674Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-qph8-6xrr-7xjw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/CodeWithCJ/SparkyFitness",
          "product": "SparkyFitness",
          "repo": "https://github.com/CodeWithCJ/SparkyFitness",
          "vendor": "CodeWithCJ",
          "versions": [
            {
              "lessThan": "0.17.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:codewithcj:sparkyfitness:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.17.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sanjorn Keeratirungsan (dizconnectz)"
        }
      ],
      "datePublic": "2026-07-09T15:39:40.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users\u0027 food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims\u0027 data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T15:40:36.888Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-qph8-6xrr-7xjw)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-qph8-6xrr-7xjw"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/CodeWithCJ/SparkyFitness/commit/79215eb4d6dda12262e1bb15b76dceb0e37f6fa1"
        },
        {
          "name": "SparkyFitness v0.17.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v0.17.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/CodeWithCJ/SparkyFitness/blob/v0.16.9/SparkyFitnessServer/services/foodCoreService.ts#L479-L498"
        },
        {
          "name": "VulnCheck Advisory: SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/sparkyfitness-before-0.17.0-missing-authorization-via-food-variants-delete-endpoint"
        }
      ],
      "title": "SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-113612",
    "datePublished": "2026-10-20T15:40:36.888Z",
    "dateReserved": "2026-10-20T11:49:08.126Z",
    "dateUpdated": "2026-10-20T16:25:31.674Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102923 (GCVE-0-2026-102923)
Vulnerability from cvelistv5
Published
2026-10-16 15:53
Modified
2026-10-28 18:20
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Summary
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL and invokes an affected AI flow. The user can save a custom AI service URL and trigger an outbound request. Successful exploitation can send server-side POST requests with a controlled bearer value, probe internal services, and disclose the AI system prompt. This issue is fixed in version 1.6.0.
References
Impacted products
Vendor Product Version
CodeWithCJ SparkyFitness Version: < 1.6.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102923",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-28T18:20:24.682661Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-28T18:20:33.855Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-rmxj-43xh-mcm3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SparkyFitness",
          "vendor": "CodeWithCJ",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL and invokes an affected AI flow. The user can save a custom AI service URL and trigger an outbound request. Successful exploitation can send server-side POST requests with a controlled bearer value, probe internal services, and disclose the AI system prompt. This issue is fixed in version 1.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T15:53:05.454Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-rmxj-43xh-mcm3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-rmxj-43xh-mcm3"
        },
        {
          "name": "https://github.com/CodeWithCJ/SparkyFitness/commit/0b43a37003a3fbedf4e38058130460fd4707fe29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CodeWithCJ/SparkyFitness/commit/0b43a37003a3fbedf4e38058130460fd4707fe29"
        },
        {
          "name": "https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v1.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v1.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rmxj-43xh-mcm3",
        "discovery": "UNKNOWN"
      },
      "title": "SparkyFitness: SSRF via unvalidated custom_url in AI service settings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102923",
    "datePublished": "2026-10-16T15:53:05.454Z",
    "dateReserved": "2026-09-29T20:24:43.339Z",
    "dateUpdated": "2026-10-28T18:20:33.855Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92263 (GCVE-0-2026-92263)
Vulnerability from cvelistv5
Published
2026-10-16 15:50
Modified
2026-10-21 02:23
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Summary
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0.
References
Impacted products
Vendor Product Version
CodeWithCJ SparkyFitness Version: < 1.6.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92263",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T02:23:10.925806Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T02:23:37.265Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-jh96-mj9m-x796"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SparkyFitness",
          "vendor": "CodeWithCJ",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T15:50:54.302Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-jh96-mj9m-x796",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-jh96-mj9m-x796"
        },
        {
          "name": "https://github.com/CodeWithCJ/SparkyFitness/commit/724730b6de5f2ca46856e0cbf113cc34f9c0689d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CodeWithCJ/SparkyFitness/commit/724730b6de5f2ca46856e0cbf113cc34f9c0689d"
        },
        {
          "name": "https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v1.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v1.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-jh96-mj9m-x796",
        "discovery": "UNKNOWN"
      },
      "title": "SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-92263",
    "datePublished": "2026-10-16T15:50:54.302Z",
    "dateReserved": "2026-09-15T22:16:18.049Z",
    "dateUpdated": "2026-10-21T02:23:37.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}