Vulnerabilities

TI-2025-20765 CVE-2025-28254 · GHSA-95j3-435g-vjcp

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated…

LOW 24

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00334 Published 2025-03-28 Fixed in 3.3 CWE-79

TI-2024-18281 CVE-2024-27477 · GHSA-fw35-8hjm-jw2p

In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation…

LOW 28

In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00628 Published 2024-04-10 No fix listed CWE-79

TI-2024-18280 CVE-2024-27476 · GHSA-cp8r-2jwf-q8jj

Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket.

MEDIUM 55

Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00646 Published 2024-04-10 No fix listed CWE-94

TI-2024-18279 CVE-2024-27474 · GHSA-rfq8-469g-mx7f

Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF).

HIGH 73

Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00651 Published 2024-04-10 No fix listed CWE-352

TI-2024-18354 CVE-2024-27705 · GHSA-c4vq-6w73-6rm7

Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute…

HIGH 68

Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files/browse endpoint.

CVSS 3.1HIGH 7.6 Adjacent network No auth No interaction EPSS 0.00556 Published 2024-04-03 No fix listed CWE-94

TI-2024-18353 CVE-2024-27703 · GHSA-vj6h-9583-2qx2

Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute…

MEDIUM 58

Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00542 Published 2024-03-13 No fix listed CWE-79

TI-2023-24586 CVE-2023-45826

Authenticated SQL Injection in leantime

LOW 33

Leantime is an open source project management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02116 Published 2023-10-19 Fixed in 2.4-beta-4 CWE-89

TI-2023-16829 CVE-2023-33961

Leantime Stored Cross-site Scripting Vulnerability

MEDIUM 41

Leantime is a lean open source project management system.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00394 Published 2023-05-30 No fix listed CWE-79

TI-2020-04348 CVE-2020-5292

Time-based blind injection in Leantime

MEDIUM 41

Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01405 Published 2020-03-31 Fixed in 2.0.15 CWE-89

Vulnerabilities

Filters