CVE-2024-44313

Exploit 🛠️ 案例研究：CVE-2024-44313 与 EPSS 在漏洞优先级排序中的应用 本案例研究是为一场关于 EPSS（漏洞利用预测评分系统）的演讲而开发，旨在展示该评分如何在实际中影响漏洞的优先级排序。 漏洞 CVE-2024-44313 存在于 TastyIgniter 3.7.6 中，允许未认证用户访问订单发票，从而暴露财务和个人数据。 EPSS 评分：0.02%（百分位 2.7%） 评估日期：2025年3月19日...

CVE-2021-38699

CVE-2021-38699 TastyIgniter 3.0.7 在用户账户创建过程中通过 name 字段允许 XSS TastyIgniter v3.0.7 的多个页面存在存储型跨站脚本漏洞，允许任意执行 JavaScript。https://vulners.com/cve/CVE-2021-38699 受影响页面： /account, /reservation, /admin/dashboard, /admin/systemlogs 受影响载荷： “ 由 Justin White 和 Matt Kiely | HuskyHacks 发现，2021 年 8 月...

CVE-2021-38699-Reflected-XSS

CVE-2021-38699 : Múltiples XSS Reflejados en TastyIgniter v3.0.7 Restaurtant CMS Existe XSS reflejado autenticado en el panel de administración de TastyIgniter en la versión 3.0.7. https://vulners.com/cve/CVE-2021-38699 POC: Parámetro start del panel de administración: POST...

CVE-2021-38699-Stored-XSS

CVE-2021-38699：TastyIgniter v3.0.7 餐厅 CMS 中的存储型 XSS TastyIgniter v3.0.7 餐厅管理系统的 Web 应用系统日志部分存在已认证的存储型跨站脚本漏洞。 https://vulners.com/cve/CVE-2021-38699 POC 1. 在 Web 应用的其他位置执行反射型跨站脚本（参见 https://github.com/HuskyHacks/CVE-2021-38699-Reflected-XSS）。 2. 导航到系统日志部分 3. XSS 载荷应触发。 4. 刷新页面。 5. XSS 载荷应触发。 发现时间...

CVE-2021-39287-Stored-XSS

CVE-2021-39287-Stored-XSS CVE-2021-39287 TastyIgniter v3.0.7 餐厅 CMS 中的存储型 XSS 漏洞 TastyIgniter v3.0.7 餐厅 CMS 中存在一个存储型跨站脚本 XSS 漏洞。位于 /admin/locations/settings 的描述输入字段未正确过滤，允许将任意代码存储在站点内。 受影响组件 URL: /admin/locations/settings 概念验证 POC 向下滚动到 "Descriptions" 输入任意句子和任意代码： "" 保存页面，将会出现一个弹出框，显示句子 All Your...

CVE-2021-38817-Remote-OS-Command-Injection

CVE-2021-38817-远程操作系统命令注入 TastyIgniter v3.0.7 Sendmail 网页部分中存在经过身份验证的远程操作系统命令注入/远程代码执行漏洞 CVE-2021-38817 TastyIgniter v3.0.7 餐厅CMS的 Sendmail 配置菜单中存在经过身份验证的远程操作系统命令注入漏洞。Sendmail 路径参数未正确清理，如字段中预填的 /usr/sbin/sendmail -bs 命令所示，通过添加分号和额外的操作系统命令可注入任意命令。 受影响组件 URL: /admin/settings/edit/mail 字段: 邮件协议:...

CVE-2022-23378

CVE-2022-23378：TastyIgniter v3.2.2 餐厅CMS中的反射型XSS 经过身份验证的反射型XSS存在于TastyIgniter管理后台的v3.2.2版本中。 Mitre URL: https://vulners.com/cve/CVE-2022-23378 NIST URL: https://nvd.nist.gov/vuln/detail/CVE-2022-23378 概念验证 POC： 管理后台 - 过敏原： 受影响的URL：...

CVE-2026-14856-TastyIgniter

CVE-2026-14856：TastyIgniter v4.3.0 中的存储型 XSS 导致账户接管 📌 摘要 在 TastyIgniter v4.3.0 的 Media Manager 文件上传功能中发现了一个存储型跨站脚本（XSS）漏洞。由于对上传的 .svg 文件验证和清理不足，经过身份验证的低权限用户可以上传包含嵌入式 JavaScript 代码的恶意文件。 当管理员查看或预览上传的文件时，有效载荷会在其会话上下文中执行。通过将此向量与跨站请求伪造（CSRF）结合，攻击者可以提取管理员的防 CSRF 令牌并触发未经授权的管理操作（例如，修改账户凭据），从而导致完全的账户接管 。...

CVE-2026-14856-TastyIgniter

CVE-2026-14856: Stored XSS to Account Takeover in TastyIgniter v4.3.0 📌 Summary A Stored Cross-Site Scripting XSS vulnerability was identified in the file upload functionality of the Media Manager in TastyIgniter v4.3.0. Due to insufficient validation and sanitization of uploaded .svg files, an...

CVE-2026-14856

A stored Cross-Site Scripting XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When...

CVE-2026-14856: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When...

CVE-2022-38256

TastyIgniter v3.5.0 was discovered to contain a cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2022-23378

A Cross-Site Scripting XSS vulnerability exists within the 3.2.2 version of TastyIgniter. The "items%5B0%5D%5Bpath%5D" parameter of a request made to /admin/allergens/edit/1 is vulnerable...

CVE-2022-0602

Cross-site Scripting XSS - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0...

CVE-2025-61417

Cross-Site Scripting XSS vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/mediamanager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to...

GHSA-4VRF-42CM-7XFW TastyIgniter vulnerable to Cross-Site Scripting

Cross-Site Scripting XSS vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/mediamanager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to...

EUVD-2025-35060

TastyIgniter vulnerable to Cross-Site Scripting...

TastyIgniter vulnerable to Cross-Site Scripting

Cross-Site Scripting XSS vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/mediamanager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to...

CVE-2025-61417

Cross-Site Scripting XSS vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/mediamanager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to...

CVE-2025-61417

Cross-Site Scripting XSS vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/mediamanager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to...