hkotel/mealie

hkotel/mealie

Releases104

Frequency2 weeks 4 days

Last Release 1 day ago

Downloads15.6M

Stars134

A Self Hosted Recipe Manager

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2022-34615 ↗	Aug 19, 2022Friday, 19 August 2022, 14:15	9.8 CRITICAL	—
Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks.
CVE-2022-34621 ↗	Aug 19, 2022Friday, 19 August 2022, 14:15	6.5 MEDIUM	—
Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR) vulnerability which allows attackers to modify user passwords and other attributes via modification of the user_id parameter.
CVE-2022-34623 ↗	Aug 19, 2022Friday, 19 August 2022, 14:15	—	—
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32425. Reason: This candidate is a duplicate of CVE-2022-32425. Notes: All CVE users should reference CVE-2022-32425 instead of this candidate.
CVE-2022-34619 ↗	Aug 2, 2022Tuesday, 2 August 2022, 22:15	5.4 MEDIUM	—
A stored cross-site scripting (XSS) vulnerability in Mealie v0.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Shopping Lists item names text field.
CVE-2022-34625 ↗	Aug 2, 2022Tuesday, 2 August 2022, 16:15	7.2 HIGH	—
Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code via a crafted Jinja2 template.
CVE-2022-34613 ↗	Aug 2, 2022Tuesday, 2 August 2022, 15:15	9.8 CRITICAL	—
Mealie 1.0.0beta3 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file.
CVE-2022-34618 ↗	Aug 2, 2022Tuesday, 2 August 2022, 15:15	5.4 MEDIUM	—
A stored cross-site scripting (XSS) vulnerability in Mealie 1.0.0beta3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the recipe description text field.