Priority HIGH 75
A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter.
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.79956 · Published 2019-05-13 · No fix listed CWE-89
Priority HIGH 72
OpenProject is open-source, web-based project management software.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00314 · Published 2026-06-26 · Fixed in 17.3.3, 17.4.1 CWE-200
Priority HIGH 68
OpenProject is an open-source project management application.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00296 · Published 2026-04-15 · Fixed in 17.3.0 CWE-307
Priority MEDIUM 64
OpenProject is open-source, web-based project management software.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00174 · Published 2026-04-20 · Fixed in 17.3.0 CWE-367
Priority MEDIUM 62
OpenProject is open-source, web-based project management software.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00356 · Published 2026-06-26 · Fixed in 17.4.0 CWE-200
Priority MEDIUM 62
OpenProject is open source project management software.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00891 · Published 2023-05-08 · Fixed in 12.5.4 CWE-613
Priority MEDIUM 59
OpenProject is open-source, web-based project management software.
CVSS 3.1MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.00253 · Published 2026-06-26 · Fixed in 17.4.0 CWE-79
Priority MEDIUM 58
OpenProject is open-source, web-based project management software.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00222 · Published 2026-06-26 · Fixed in 17.3.3, 17.4.1 CWE-639
Priority MEDIUM 45
OpenProject is an open-source, web-based project management software.
CVSS 4.0HIGH 8.6· Network · High privileges · No interaction · EPSS 0.00378 · Published 2026-01-10 · Fixed in 16.6.2 CWE-77
Priority MEDIUM 43
OpenProject is open-source, web-based project management software.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.00377 · Published 2026-06-26 · Fixed in 17.3.3, 17.4.1 CWE-89
Priority MEDIUM 43
OpenProject is open-source, web-based project management software.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.00454 · Published 2026-06-26 · Fixed in 17.3.3, 17.4.1 CWE-639
Priority MEDIUM 43
OpenProject is open-source, web-based project management software.
CVSS 3.1CRITICAL 9.6· Adjacent network · No auth · No interaction · EPSS 0.0039 · Published 2026-06-26 · Fixed in 17.3.3, 17.4.1 CWE-20
Priority MEDIUM 43
OpenProject is open-source, web-based project management software.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.0049 · Published 2026-06-26 · Fixed in 17.2.4, 17.3.2 CWE-1188
Priority MEDIUM 43
OpenProject is an open-source, web-based project management software.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.00274 · Published 2026-04-02 · Fixed in 17.2.3 CWE-89
Priority MEDIUM 43
OpenProject is an open-source, web-based project management software.
CVSS 4.0CRITICAL 9.4· Network · Low privileges · No interaction · EPSS 0.00511 · Published 2026-02-06 · Fixed in 16.6.7, 17.0.3 CWE-78
Priority MEDIUM 43
OpenProject is an open-source, web-based project management software.
CVSS 4.0CRITICAL 9.4· Network · Low privileges · No interaction · EPSS 0.0037 · Published 2026-01-28 · Fixed in 16.6.6, 17.0.2 CWE-77
Priority MEDIUM 41
OpenProject is an open-source, web-based project management software.
CVSS 3.1CRITICAL 9.1· Network · Low privileges · User interaction · EPSS 0.00196 · Published 2026-03-18 · Fixed in 16.6.9, 17.0.6 +2 CWE-79
Priority MEDIUM 41
OpenProject is an open-source, web-based project management software.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.0028 · Published 2026-03-18 · Fixed in 16.6.9, 17.0.6 +2 CWE-89
Priority MEDIUM 41
OpenProject is web-based project management software.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01257 · Published 2023-06-01 · Fixed in 12.5.6 CWE-200
Priority MEDIUM 40
OpenProject is open-source, web-based project management software.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00241 · Published 2026-06-26 · Fixed in 17.3.3, 17.4.1 CWE-352
Priority MEDIUM 40
OpenProject is a web-based project management software.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00959 · Published 2021-12-14 · Fixed in 12.0.4 CWE-89
Priority LOW 39
OpenProject is an open-source, web-based project management software.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.00247 · Published 2026-01-19 · Fixed in 16.6.5 CWE-79
Priority LOW 39
OpenProject is an open-source, web-based project management software.
CVSS 3.1CRITICAL 9.1· Network · Low privileges · No interaction · EPSS 0.00304 · Published 2026-01-10 · Fixed in 16.6.4 CWE-200
Priority LOW 38
OpenProject is an open-source, web-based project management software.
CVSS 3.1CRITICAL 9.0· Network · Low privileges · User interaction · EPSS 0.00184 · Published 2026-01-28 · No fix listed CWE-345
Priority LOW 38
OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.0142 · Published 2017-07-26 · No fix listed CWE-613
Load more
THREATIST.IORead the docs