Login Request a demo
High severity · published Oct 20, 2025
CVE-2025-61417
Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to perform unauthorized actions such as modifying the admin account credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Tastyigniter · Tastyigniter
3.7.7 · source: NVD
Affected product
TA
Tastyigniter
Tastyigniter
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-61417
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-61417
Exploit
https://github.com/mg7-x/CVEs/blob/main/CVE-2025-61417/README.md
Product
https://github.com/tastyigniter/TastyIgniter
More from Tastyigniter
8.1
CVE-2024-44313
TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized users to access and generate invoices…
7.2
CVE-2026-29001
TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization
6.5
CVE-2024-44314
TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses
5.4
CVE-2022-38256
TastyIgniter v3.5.0 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload
5.4
CVE-2022-0602
Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0