recipes.

Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL

• recipes
• Server-side request forgery (SSRF)

Tandoor Recipes: Blind SSRF via AI provider URL (api_base)

• recipes
• Server-side request forgery (SSRF)

Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content

• recipes
• Broken access control

Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns

• recipes
• Denial of service

Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints

• recipes
• Broken access control

Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes

• recipes
• Other injection

Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport

• recipes
• Broken access control

Tandoor Recipes Affected by Denial of Service via Recipe Import

• recipes
• CWE-409

Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`

• recipes
• Broken access control
• CWE-1284

Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users

• recipes
• CWE-749

Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level)

• recipes
• Cross-site scripting (XSS)

Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification

• recipes
• Broken access control

Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication

• recipes
• Authentication bypass

Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control Logic

• recipes
• SQL injection

URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key

• recipes
• Other injection

Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII

• recipes
• CWE-1230

Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404

• recipes
• Broken access control

Tandoor Recipes Vulnerable to Host Header Injection

• recipes
• CWE-644

Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import

• recipes
• Server-side request forgery (SSRF)

Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read

• recipes
• Path traversal

Tandoor Recipes - Stored XSS through Unrestricted File Upload

• recipes
• Unrestricted file upload

Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server

• recipes
• Information disclosure

Tandoor Recipes - SSTI - Remote Code Execution

• recipes
• Code injection

Recipes 1.5.10 - Blind SSRF

• Recipes
• Server-side request forgery (SSRF)

Recipes - Stored XSS in Name Parameter

• recipes
• Cross-site scripting (XSS)

Recipes - Stored XSS in Clipboard

• recipes
• Cross-site scripting (XSS)

Recipes - Stored XSS in Add to Cart

• recipes
• Cross-site scripting (XSS)

Recipes - SSRF on Import

• recipes
• Server-side request forgery (SSRF)