Vulnerabilities

Filters

2 selected

37 records

Sort

Vendor: opf Component: Openproject Clear all filters

TI-2026-29552 CVE-2026-40896

OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup

MEDIUM 64

OpenProject is open-source, web-based project management software.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00174 Published 2026-04-20 Fixed in 17.3.0 CWE-367

TI-2026-26047 CVE-2026-33667

OpenProject: 2FA OTP Verification Missing Rate Limiting

HIGH 68

OpenProject is an open-source project management application.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00296 Published 2026-04-15 Fixed in 17.3.0 CWE-307

TI-2026-26961 CVE-2026-34717

OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string

MEDIUM 43

OpenProject is an open-source, web-based project management software.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-02 Fixed in 17.2.3 CWE-89

TI-2026-25195 CVE-2026-32703

OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy

MEDIUM 41

OpenProject is an open-source, web-based project management software.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00196 Published 2026-03-18 Fixed in 16.6.9, 17.0.6 +2 CWE-79

TI-2026-25190 CVE-2026-32698

OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution

MEDIUM 41

OpenProject is an open-source, web-based project management software.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.0028 Published 2026-03-18 Fixed in 16.6.9, 17.0.6 +2 CWE-89

TI-2026-24518 CVE-2026-31974

Blind SSRF on OpenProject instance via webhooks

LOW 19

OpenProject is an open-source, web-based project management software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00181 Published 2026-03-11 Fixed in 17.2.0 CWE-918

TI-2026-23472 CVE-2026-30239

OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets

LOW 31

OpenProject is an open-source, web-based project management software.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.0022 Published 2026-03-11 Fixed in 17.2.0 CWE-863

TI-2026-23469 CVE-2026-30236

OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate

LOW 19

OpenProject is an open-source, web-based project management software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-03-11 Fixed in 17.2.0 CWE-863

TI-2026-23468 CVE-2026-30235

Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering

LOW 29

OpenProject is an open-source, web-based project management software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00374 Published 2026-03-11 Fixed in 17.2.0 CWE-79

TI-2026-23467 CVE-2026-30234

OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)

LOW 29

OpenProject is an open-source, web-based project management software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00351 Published 2026-03-11 Fixed in 17.2.0 CWE-22

TI-2026-22088 CVE-2026-27723

OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects

LOW 24

OpenProject is an open-source, web-based project management software.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00243 Published 2026-03-05 Fixed in 17.0.5, 17.1.2 CWE-284

TI-2026-19978 CVE-2026-24777

OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts

LOW 30

OpenProject is an open-source, web-based project management software.

CVSS 3.1MEDIUM 6.7 Network High privileges No interaction EPSS 0.00382 Published 2026-02-09 Fixed in 17.0.2 CWE-862

TI-2026-20830 CVE-2026-25763

Command Injection on OpenProject repositories leads to Remote Code Execution

MEDIUM 43

OpenProject is an open-source, web-based project management software.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00511 Published 2026-02-06 Fixed in 16.6.7, 17.0.3 CWE-78

TI-2026-20831 CVE-2026-25764

OpenProject vulnerable to Stored HTML injection

LOW 17

OpenProject is an open-source, web-based project management software.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00274 Published 2026-02-06 Fixed in 16.6.7, 17.0.3 CWE-80

TI-2026-19977 CVE-2026-24776

OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer

LOW 19

OpenProject is an open-source, web-based project management software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00225 Published 2026-02-06 Fixed in 17.0.2 CWE-639

TI-2026-19976 CVE-2026-24775

Insufficient verification of data authenticity in opf openproject

LOW 31

OpenProject is an open-source, web-based project management software.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00128 Published 2026-01-28 Fixed in 17.0.2 CWE-345

TI-2026-19973 CVE-2026-24772

OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server

LOW 38

OpenProject is an open-source, web-based project management software.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00184 Published 2026-01-28 No fix listed CWE-345

TI-2026-19907 CVE-2026-24685

OpenProject has Argument Injection on Repository module that allows Arbitrary File Write

MEDIUM 43

OpenProject is an open-source, web-based project management software.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.0037 Published 2026-01-28 Fixed in 16.6.6, 17.0.2 CWE-77

TI-2026-19094 CVE-2026-23721

OpenProject users with "View Members" permission in any project can view all Group memberships

LOW 19

OpenProject is an open-source, web-based project management software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00209 Published 2026-01-19 Fixed in 16.6.5 CWE-862

TI-2026-19040 CVE-2026-23646

OpenProject users can delete other user's session, causing them to be logged out

LOW 29

OpenProject is an open-source, web-based project management software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00374 Published 2026-01-19 Fixed in 16.6.5 CWE-488

TI-2026-19026 CVE-2026-23625

OpenProject has stored XSS regression using attachments and script-src self

LOW 39

OpenProject is an open-source, web-based project management software.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00247 Published 2026-01-19 Fixed in 16.6.5 CWE-79

TI-2026-18166 CVE-2026-22605

OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings

LOW 19

OpenProject is an open-source, web-based project management software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00229 Published 2026-01-10 Fixed in 16.6.3 CWE-284

TI-2026-18165 CVE-2026-22604

OpenProject is vulnerable to user enumeration via the change password function

LOW 36

OpenProject is an open-source, web-based project management software.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00302 Published 2026-01-10 Fixed in 16.6.2 CWE-200

TI-2026-18164 CVE-2026-22603

OpenProject has no protection against brute-force attacks in the Change Password function

LOW 36

OpenProject is an open-source, web-based project management software.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00262 Published 2026-01-10 Fixed in 16.6.2 CWE-307

TI-2026-18163 CVE-2026-22602

OpenProject is Vulnerable to User Enumeration via User ID

LOW 17

OpenProject is an open-source, web-based project management software.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.0029 Published 2026-01-10 Fixed in 16.6.2 CWE-200