CVE-2024-44313

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks...

CVE-2024-44313

Summary: CVE-2024-44313 affects TastyIgniter 3.7.6. An Incorrect Access Control flaw in the invoice() function of Orders.php allows unauthorized users to access and generate invoices due to missing permission checks. What’s affected: TastyIgniter 3.7.6; vulnerable component: app/admin/controllers...

CVE-2024-44314

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the indexonUpdateStatus function within Orders.php, which fails to verify if the user has permission to modify an order'...