What’s Vulnerable › Products

CodeWithCJ SparkyFitness vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your CodeWithCJ SparkyFitness version is affected

Latest CodeWithCJ SparkyFitness vulnerabilities

• CVE-2026-113612 — SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint (CVSS 5.4)
• CVE-2026-92263 — SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore (CVSS 7.2)
• CVE-2026-102923 — SparkyFitness: SSRF via unvalidated custom_url in AI service settings (CVSS 5.4)
• CVE-2025-65368 — (CVSS 6.1)