opf

Records58All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical11CVSS 9.0–10.0

CVSS high15CVSS 7.0–8.9

Exploited now

opf records in CISA KEV

No opf vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Openproject 37 records HIGH

Records

37 records in Openproject · all components

TI-2019-08673 CVE-2019-11600 · GHSA-c233-43hc-2x3j

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a…

HIGH 75

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.79956 Published 2019-05-13 No fix listed CWE-89

TI-2026-26047 CVE-2026-33667

OpenProject: 2FA OTP Verification Missing Rate Limiting

HIGH 68

OpenProject is an open-source project management application.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00296 Published 2026-04-15 Fixed in 17.3.0 CWE-307

TI-2026-29552 CVE-2026-40896

OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup

MEDIUM 64

OpenProject is open-source, web-based project management software.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00174 Published 2026-04-20 Fixed in 17.3.0 CWE-367

TI-2023-14850 CVE-2023-31140

OpenProject user sessions not terminated after activation of 2FA

MEDIUM 62

OpenProject is open source project management software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00891 Published 2023-05-08 Fixed in 12.5.4 CWE-613

TI-2026-18162 CVE-2026-22601

OpenProject is Vulnerable to Code Execution in E-Mail function

MEDIUM 45

OpenProject is an open-source, web-based project management software.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00378 Published 2026-01-10 Fixed in 16.6.2 CWE-77

TI-2026-26961 CVE-2026-34717

OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string

MEDIUM 43

OpenProject is an open-source, web-based project management software.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-02 Fixed in 17.2.3 CWE-89

TI-2026-20830 CVE-2026-25763

Command Injection on OpenProject repositories leads to Remote Code Execution

MEDIUM 43

OpenProject is an open-source, web-based project management software.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00511 Published 2026-02-06 Fixed in 16.6.7, 17.0.3 CWE-78

TI-2026-19907 CVE-2026-24685

OpenProject has Argument Injection on Repository module that allows Arbitrary File Write

MEDIUM 43

OpenProject is an open-source, web-based project management software.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.0037 Published 2026-01-28 Fixed in 16.6.6, 17.0.2 CWE-77

TI-2026-25195 CVE-2026-32703

OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy

MEDIUM 41

OpenProject is an open-source, web-based project management software.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00196 Published 2026-03-18 Fixed in 16.6.9, 17.0.6 +2 CWE-79

TI-2026-25190 CVE-2026-32698

OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution

MEDIUM 41

OpenProject is an open-source, web-based project management software.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.0028 Published 2026-03-18 Fixed in 16.6.9, 17.0.6 +2 CWE-89

TI-2023-16828 CVE-2023-33960

OpenProject vulnerable to project identifier information leakage through robots.txt

MEDIUM 41

OpenProject is web-based project management software.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01257 Published 2023-06-01 Fixed in 12.5.6 CWE-200

TI-2021-19636 CVE-2021-43830

SQL injection in OpenProject

MEDIUM 40

OpenProject is a web-based project management software.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00959 Published 2021-12-14 Fixed in 12.0.4 CWE-89

TI-2026-19026 CVE-2026-23625

OpenProject has stored XSS regression using attachments and script-src self

LOW 39

OpenProject is an open-source, web-based project management software.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00247 Published 2026-01-19 Fixed in 16.6.5 CWE-79

TI-2026-18161 CVE-2026-22600

OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder

LOW 39

OpenProject is an open-source, web-based project management software.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00304 Published 2026-01-10 Fixed in 16.6.4 CWE-200

TI-2026-19973 CVE-2026-24772

OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server

LOW 38

OpenProject is an open-source, web-based project management software.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00184 Published 2026-01-28 No fix listed CWE-345

TI-2017-08639 CVE-2017-11667 · GHSA-2w7h-66vj-246p

OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows…

LOW 38

OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.0142 Published 2017-07-26 No fix listed CWE-613

TI-2026-18165 CVE-2026-22604

OpenProject is vulnerable to user enumeration via the change password function

LOW 36

OpenProject is an open-source, web-based project management software.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00302 Published 2026-01-10 Fixed in 16.6.2 CWE-200

TI-2026-18164 CVE-2026-22603

OpenProject has no protection against brute-force attacks in the Change Password function

LOW 36

OpenProject is an open-source, web-based project management software.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00262 Published 2026-01-10 Fixed in 16.6.2 CWE-307

TI-2024-23294 CVE-2024-35224

Stored Cross-Site Scripting (XSS) in OpenProject

LOW 33

OpenProject is the leading open source project management software.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00328 Published 2024-05-23 Fixed in 13.4.2, 14.1.0 +1 CWE-80

TI-2026-23472 CVE-2026-30239

OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets

LOW 31

OpenProject is an open-source, web-based project management software.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.0022 Published 2026-03-11 Fixed in 17.2.0 CWE-863

TI-2026-19976 CVE-2026-24775

Insufficient verification of data authenticity in opf openproject

LOW 31

OpenProject is an open-source, web-based project management software.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00128 Published 2026-01-28 Fixed in 17.0.2 CWE-345

TI-2021-12430 CVE-2021-32763

Regular Expression Denial of Service in OpenProject forum messages

LOW 31

OpenProject is open-source, web-based project management software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00921 Published 2021-07-20 Fixed in 11.3.3 CWE-400

TI-2019-12749 CVE-2019-17092 · GHSA-26f4-fvxg-f5mr

An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2…

LOW 31

An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled.