Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-14856-TastyIgniter — CVE-2026-14856 TastyIgniter v4.3.0 | Kitploit
Tools/GitHubGitHub/jonas-fernandez-as/cve-2026-14856-tastyigniter
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration TestingLearning & Education
GitHubjonas-fernandez-as/cve-2026-14856-tastyigniter

CVE-2026-14856-TastyIgniter

CVE-2026-14856 TastyIgniter v4.3.0

View Repository
11 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-14856: Stored XSS to Account Takeover in TastyIgniter v4.3.0

INCIBE-CERT CVSS v4.0 CWE-79

📌 Summary

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the file upload functionality of the Media Manager in TastyIgniter v4.3.0. Due to insufficient validation and sanitization of uploaded .svg files, an authenticated low-privileged user can upload a malicious file containing embedded JavaScript code.

When an administrator views or previews the uploaded file, the payload executes within the context of their session. By chaining this vector with Cross-Site Request Forgery (CSRF), an attacker can extract the administrator's anti-CSRF token and trigger unauthorized administrative actions (e.g., modifying account credentials), resulting in a full Account Takeover.

📊 Technical Overview

PropertyValue
CVE IDCVE-2026-14856
INCIBE AdvisoryINCIBE-2026-511
Affected ComponentMedia Manager
Vulnerable VersionTastyIgniter v4.3.0
Vulnerability TypeCWE-79 (Stored Cross-Site Scripting)
CVSS v4.0 Score6.3 (Medium)
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Discovered ByJonas Fernández

⚙️ Exploitation Chain

  1. Upload Phase: An authenticated low-privilege user uploads an SVG file containing a malicious JavaScript payload to the Media Manager.
  2. Execution Phase: An administrator views the file, executing the embedded JavaScript in their browser session context.
  3. Token Extraction: The script programmatically extracts the administrator's active CSRF token.
  4. Account Takeover: The script issues an authenticated request using the stolen token to update administrative credentials (email/password).

📁 Proof of Concept (PoC)

The full technical report, step-by-step breakdown, and analysis are available in PDF format within this repository:

📄 TastyIgniter-4.3.0-POC.pdf

🛡️ Remediation & Coordinated Disclosure

  • Vendor Status: Fixed in the latest release by the manufacturer. Updating to the newest version is recommended.
  • Coordination: Disclosed responsibly through INCIBE-CERT Coordinated Vulnerability Disclosure (CVD).
  • Official Advisory: INCIBE-CERT Notice

👤 Author

Jonas Fernández

Download Tool