Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 25

Export CSV
CVE-2025-23211

Tandoor Recipes - SSTI - Remote Code Execution

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.

CVSS 3.1 · 10 Critical EPSS 3.7% KEV · Not listed
Vendors
Tandoor
Products
Recipes
CVE-2022-23074

Recipes - Stored XSS in Name Parameter

In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.

CVSS 2.0 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Tandoor
Products
Recipes
CVE-2022-23073

Recipes - Stored XSS in Clipboard

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the clipboard icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.

CVSS 2.0 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Tandoor
Products
Recipes
CVE-2022-23072

Recipes - Stored XSS in Add to Cart

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.

CVSS 2.0 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Tandoor
Products
Recipes
CVE-2022-23071

Recipes - SSRF on Import

In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Tandoor
Products
Recipes