Security: CodeWithCJ/SparkyFitness
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restoreGHSA-jh96-mj9m-x796 published
Jul 24, 2026 by CodeWithCJHigh -
Missing owner check in deleteFoodVariant lets any authenticated user delete another user's public-food variantsGHSA-qph8-6xrr-7xjw published
Jul 9, 2026 by CodeWithCJModerate -
SSRF via unvalidated custom_url in AI service settingsGHSA-rmxj-43xh-mcm3 published
Jul 24, 2026 by CodeWithCJModerate -
Stored XSS in versions <= v0.15.8.2GHSA-j7x6-6678-2xqp published
Jan 15, 2026 by CodeWithCJModerate
Learn more about advisories related to CodeWithCJ/SparkyFitness in the GitHub Advisory Database