Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to perform unauthorized actions such as modifying the admin account credentials.
References
| Link | Resource |
|---|---|
| https://github.com/mg7-x/CVEs/blob/main/CVE-2025-61417/README.md | Exploit Third Party Advisory |
| https://github.com/tastyigniter/TastyIgniter | Product |
Configurations
History
12 Nov 2025, 17:32
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Tastyigniter
Tastyigniter tastyigniter |
|
| References | () https://github.com/mg7-x/CVEs/blob/main/CVE-2025-61417/README.md - Exploit, Third Party Advisory | |
| References | () https://github.com/tastyigniter/TastyIgniter - Product | |
| CPE | cpe:2.3:a:tastyigniter:tastyigniter:3.7.7:*:*:*:*:*:*:* |
20 Oct 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 CWE-434 |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
20 Oct 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-20 15:15
Updated : 2025-11-12 17:32
NVD link : CVE-2025-61417
Mitre link : CVE-2025-61417
CVE.ORG link : CVE-2025-61417
JSON object : View
Products Affected
tastyigniter
- tastyigniter