Vulnerabilities

TI-2026-79001 CVE-2026-29001 · GHSA-736x-jrr3-jq2x

PHP object injection in TastyIgniter enables command execution

MEDIUM 41

TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is st…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00786 Published 2026-10-21 No fix listed CWE-502

TI-2025-37990 CVE-2025-61417 · GHSA-4vrf-42cm-7xfw

Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the…

HIGH 73

Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00598 Published 2025-10-20 No fix listed CWE-434

TI-2024-29866 CVE-2024-44314 · GHSA-w5h7-mw56-4v7x

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders…

LOW 29

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00292 Published 2025-03-18 Fixed in 4.0.0 CWE-285

TI-2024-29865 CVE-2024-44313 · GHSA-gg2f-r4jh-vpmh

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice()…

LOW 39

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00737 Published 2025-03-18 Fixed in 4.0.0 CWE-284

TI-2022-17928 CVE-2022-38256 · GHSA-f6mm-2q2w-87fg

TastyIgniter v3.5.0 was discovered to contain a cross-site scripting (XSS) vulnerability…

LOW 25

TastyIgniter v3.5.0 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00618 Published 2022-09-08 No fix listed CWE-79

TI-2022-00519 CVE-2022-0602 · GHSA-cjw5-f2x5-r4q5

Cross-site Scripting (XSS) - DOM in tastyigniter/tastyigniter

LOW 26

Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00719 Published 2022-04-05 Fixed in 3.3.0 CWE-79

TI-2022-07469 CVE-2022-23378 · GHSA-wcvv-m4vf-mqw9

A Cross-Site Scripting (XSS) vulnerability exists within the 3.2.2 version of…

LOW 27

A Cross-Site Scripting (XSS) vulnerability exists within the 3.2.2 version of TastyIgniter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01096 Published 2022-02-09 No fix listed CWE-79

TI-2021-16270 CVE-2021-38699 · GHSA-q8pf-c38m-9q2x

TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/system_logs.

LOW 35

TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/system_logs.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.08042 Published 2021-08-15 No fix listed CWE-79

Vulnerabilities

Filters