CodeWithCJ has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 6.3 (medium).

CVEs per month

Last 12 months, by publish date

1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10

Exploited share: 0% vs 1% corpus
Median CVSS: 6.3
Publish → KEV: —
Last 90 days: 2 prev 0

Weakness classes

Products

SparkyFitness 2

Follow CodeWithCJ:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

CodeWithCJ vulnerabilities

CVEs affecting CodeWithCJ, newest first. Open any entry for full detail, references, and exploit status.

2 CVEsRSS

CVE-2026-102923Medium· 5.4

today

SparkyFitness: SSRF via unvalidated custom_url in AI service settings

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in…

▾ SunlitCodeWithCJ · SparkyFitnessvia CVEORG

CVE-2026-92263High· 7.2

today

SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploa…

▾ TwilightCodeWithCJ · SparkyFitnessvia CVEORG