Cross Site Scripting Vulnerability in SparkyFitness by CodeWithCJ
CVE-2025-65368

6.1MEDIUM

Key Information:

Vendor

CodeWithCJ

Status
SparkyFitness
Vendor
CVE Published:
15 January 2026

What is CVE-2025-65368?

SparkyFitness v0.15.8.2 has a security flaw that enables attackers to exploit Cross Site Scripting (XSS) via malicious user input and LLM outputs. This vulnerability can potentially allow unauthorized access to sensitive user data and manipulation of web content, emphasizing the need for immediate attention and patching to maintain web application security.

References

https://github.com/CodeWithCJ/SparkyFitness
https://github.com/CodeWithCJ/SparkyFitness/security/advi...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.