CVE-2026-57862 | High | 8.5 | 2026-07-30 | Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadeci… |
CVE-2026-58660 | High | 8.1 | 2026-07-15 | Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's ro… |
CVE-2026-56774 | Medium | 5.4 | 2026-06-25 | Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeS… |
CVE-2026-33058 | Medium | 6.5 | 2026-03-18 | Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers wi… |
CVE-2026-29056 | High | 8.8 | 2026-03-18 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint (`UserInviteController::re… |
CVE-2026-25531 | Medium | 4.3 | 2026-02-13 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The TaskCreationController::d… |
CVE-2026-25924 | High | 8.4 | 2026-02-11 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authentic… |
CVE-2026-25530 | Medium | 4.3 | 2026-02-10 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing… |
CVE-2026-24885 | Medium | 5.7 | 2026-02-10 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Project… |
CVE-2026-21881 | Critical | 9.1 | 2026-01-08 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE… |
CVE-2026-21880 | Medium | 5.3 | 2026-01-08 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authenticatio… |
CVE-2026-21879 | Medium | 4.7 | 2026-01-08 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows maliciou… |
CVE-2025-55011 | Medium | 6.4 | 2025-08-12 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, the createTaskFile method in the API does not validate… |
CVE-2025-55010 | Critical | 9.1 | 2025-08-12 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the Project… |
CVE-2025-52576 | Medium | 5.3 | 2025-06-25 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP… |
CVE-2025-52560 | High | 8.1 | 2025-06-24 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with… |
CVE-2025-46825 | Medium | 5.4 | 2025-05-12 | Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting (XSS) Vulnera… |
CVE-2024-55603 | Medium | 6.5 | 2024-12-19 | Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has e… |
CVE-2024-54001 | Medium | 5.5 | 2024-12-05 | Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fiel… |
CVE-2024-51748 | Critical | 9.1 | 2024-11-11 | Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code on the server in com… |
CVE-2024-51747 | Critical | 9.1 | 2024-11-11 | Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the se… |
CVE-2024-36399 | High | 8.2 | 2024-06-06 | Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(… |
CVE-2024-22720 | Medium | 4.8 | 2024-01-24 | Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature. |
CVE-2023-36813 | High | 7.1 | 2023-07-05 | Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to perform a SQL Injectio… |
CVE-2023-33970 | Medium | 5.4 | 2023-06-05 | Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access control` was found, wh… |
CVE-2023-33969 | Medium | 6.4 | 2023-06-05 | Kanboard is open source project management software that focuses on the Kanban methodology. A stored Cross site scripting (XSS) allows an attacker to execute a… |
CVE-2023-33968 | Medium | 5.4 | 2023-06-05 | Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missing access control vu… |
CVE-2023-33956 | Medium | 4.3 | 2023-06-05 | Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object r… |
CVE-2023-32685 | Medium | 4.4 | 2023-05-30 | Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEditable` element, malic… |
CVE-2019-7324 | Medium | 6.1 | 2019-02-04 | app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting. |
CVE-2017-15212 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another user. |
CVE-2017-15211 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user. |
CVE-2017-15210 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another user. |
CVE-2017-15209 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user. |
CVE-2017-15208 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user. |
CVE-2017-15207 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user. |
CVE-2017-15206 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user. |
CVE-2017-15205 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user. |
CVE-2017-15204 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user. |
CVE-2017-15203 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user. |
CVE-2017-15202 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user. |
CVE-2017-15201 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user. |
CVE-2017-15200 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user. |
CVE-2017-15199 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email… |
CVE-2017-15198 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of another user. |
CVE-2017-15197 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user. |
CVE-2017-15196 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user. |
CVE-2017-15195 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user. |
CVE-2017-12851 | High | 8.8 | 2017-08-14 | An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46. |
CVE-2017-12850 | High | 8.8 | 2017-08-14 | An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46. |
CVE-2014-3920 | | | 2014-07-03 | Cross-site request forgery (CSRF) vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrators for requests th… |