CVE-2026-59962

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sortorder and orderfield strings into Django ORM orderby calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or...

CVE-2026-59962

Prior to version 2.6.10 , the Tandoor Recipes application is vulnerable to an ORM ORDER BY Injection via foreign-key traversal. The application fails to validate sort_order and order_field strings passed into Django ORM order_by() calls during recipe searches, RecipeBook actions, or via CustomFil...

PT-2026-115664

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort order and order field strings into Django ORM order by calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, ...