CVE-2026-54418 | High | 8.1 | 2026-08-05 | Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-s… |
CVE-2026-66416 | High | 8.8 | 2026-07-30 | Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authent… |
CVE-2026-66415 | High | 8.5 | 2026-07-30 | Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by… |
CVE-2026-66414 | Medium | 6.1 | 2026-07-30 | Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitra… |
CVE-2026-66412 | Medium | 6.5 | 2026-07-27 | Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assig… |
CVE-2026-59713 | High | 8.1 | 2026-07-06 | Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers… |
CVE-2026-59712 | High | 8.1 | 2026-07-06 | Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows incl… |
CVE-2025-28254 | Medium | 5.4 | 2025-03-28 | Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information vi… |
CVE-2024-27477 | Medium | 6.1 | 2024-04-10 | In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject maliciou… |
CVE-2024-27476 | Medium | 4.7 | 2024-04-10 | Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. |
CVE-2024-27474 | High | 8.8 | 2024-04-10 | Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of auth… |
CVE-2024-27705 | High | 7.6 | 2024-04-03 | Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files/browse endpoint. |
CVE-2024-27703 | Medium | 5.4 | 2024-03-13 | Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter. |
CVE-2023-45826 | Medium | 6.5 | 2023-10-19 | Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authentic… |
CVE-2023-33961 | High | 8.9 | 2023-05-30 | Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Jav… |
CVE-2020-5292 | High | 8.7 | 2020-03-31 | Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL querie… |