CVE-2025-56795

CVE-2025-56795 描述 在 Mealie 的菜谱创建功能中发现了两个存储型跨站脚本（XSS）漏洞，影响包括 3.0.1 在内的所有版本。 菜谱创建过程中提供的未经过滤的用户输入被存储，随后在前端渲染时未进行适当转义，导致持久性XSS。 受影响字段 在创建新菜谱时，以下字段存在漏洞： 1. 配料备注（note 参数）： 该字段的输入会被存储，并在菜谱详情视图中渲染，允许执行注入的JavaScript载荷。 2. 操作说明文本（text 参数）： 该字段的输入同样会被存储并在菜谱详情视图中渲染，在查看菜谱时导致JavaScript执行。 概念验证 显示创建新菜谱后 JSON...

CVE-2025-56795

Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting XSS in the recipe creation functionality. Unsanitized user input in the "note" and "text" fields of the "/api/recipes/recipename" endpoint is rendered in the frontend without proper escaping leading to persistent XSS...

CVE-2025-56795

Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting XSS in the recipe creation functionality. Unsanitized user input in the "note" and "text" fields of the "/api/recipes/recipename" endpoint is rendered in the frontend without proper escaping leading to persistent XSS...

CVE-2025-56795

Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting XSS in the recipe creation functionality. Unsanitized user input in the "note" and "text" fields of the "/api/recipes/recipename" endpoint is rendered in the frontend without proper escaping leading to persistent XSS...

CVE-2025-56795: Improper Neutralization of Input During Web Page Generation

Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting XSS in the recipe creation functionality. Unsanitized user input in the "note" and "text" fields of the "/api/recipes/recipename" endpoint is rendered in the frontend without proper escaping leading to persistent XSS...

CVE-2025-56795

Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting XSS in the recipe creation functionality. Unsanitized user input in the "note" and "text" fields of the "/api/recipes/recipename" endpoint is rendered in the frontend without proper escaping leading to persistent XSS...

CVE-2025-56795

Mealie versions 3.0.1 and earlier are vulnerable to Stored Cross-Site Scripting (XSS) within the recipe creation functionality. The root cause is the lack of proper sanitization and escaping for user-supplied input in the note and text fields of the /api/recipes/{recipe_name} endpoint. This unsan...

PT-2025-39839

Name of the Vulnerable Software and Affected Versions Mealie versions prior to 3.0.1 Description The software is susceptible to Cross-Site Scripting XSS within the recipe creation feature. User-provided data in the "note" and "text" fields is not adequately sanitized before being displayed on the...

Exploit for CVE-2025-56795

CVE-2025-56795 Description Two stored Cross-Site Scripti...

Joomla Rapid Recipe Persistent XSS Vulnerability

Exploit for php platform in category web applications ================================================ Joomla Rapid Recipe Persistent XSS Vulnerability ================================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\...