CVE-2025-55203 Plane Stored XSS in Add Work Item Functionality

Plane is open-source project management software. Prior to version 0.28.0, a stored cross-site scripting XSS vulnerability exists in the descriptionhtml field of Plane. This flaw allows an attacker to inject malicious JavaScript code that is stored and later executed in other users’ browsers. The...

CVE-2025-55203 Plane Stored XSS in Add Work Item Functionality

Plane is open-source project management software. Prior to version 0.28.0, a stored cross-site scripting XSS vulnerability exists in the descriptionhtml field of Plane. This flaw allows an attacker to inject malicious JavaScript code that is stored and later executed in other users’ browsers. The...

CVE-2025-55203

Plane is an open‑source project management tool. A stored XSS vulnerability exists in the description_html field prior to version 0.28.0, where unsanitized/uncleaned input allows attacker‑provided JavaScript to be saved in the database and executed in other users’ browsers. Impacts include potent...

CVE-2025-55010 Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event"data" field in the...

Pushing Boundaries With Claude Code

Claude Code stormed onto the programming scene when Anthropic launched it in February of this year. It moved, what Andrej Karpathy has called "The Autonomy Slider" from around a three to a solid eight. What this means is that you can give Claude Code direction, it will come up with a plan to...

Project Management 安全漏洞

Project Management is an open source project management tool from DEVASLAN - PHP Open Source. A security vulnerability exists in Project Management v1.2.4, which stems from a stored cross-site scripting vulnerability that could lead to the execution of arbitrary JavaScript code...

The vulnerability of the JetBrains YouTrack project management and task management software, related to errors in the user interface’s information presentation, allows attackers to circumvent existing security restrictions.

The vulnerability of the JetBrains YouTrack project and task management software is related to errors in the user interface’s information presentation. Exploiting this vulnerability can allow an attacker to circumvent existing security restrictions remotely...

CVE-2025-7886 pmTicket Project-Management-Software class.database.php getUserLanguage sql injection

A vulnerability, which was classified as critical, was found in pmTicket Project-Management-Software up to 2ef379da2075f4761a2c9029cf91d073474e7486. This affects the function getUserLanguage of the file classes/class.database.php. The manipulation of the argument userid leads to sql injection. It...

CVE-2025-49974

Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through = 2.1.1...

CVE-2025-49974

CVE-2025-49974 describes a Missing/Misconfigured Authorization vulnerability in UpStream: a Project Management Plugin for WordPress. Affected software: UpStream versions up to and including 2.1.0. Root cause: broken/missing access control, allowing unauthorized access due to incorrectly configure...

CVE-2025-49974 WordPress UpStream: a Project Management Plugin for WordPress plugin <= 2.1.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through = 2.1.1...

WordPress UpStream: a Project Management Plugin for WordPress plugin <= 2.1.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin UpStream: a Project Management Plugin for WordPress versions = 2.1.1...

Allegra 路径遍历漏洞

Allegra is a project management software for mid-sized organizations from Allegra. A path traversal vulnerability exists in Allegra that stems from the extractFileFromZip method not properly validating a user-supplied path, which could lead to remote code execution...

The vulnerability of the Hibernate query service implementation in the Kaiten project management system lies in the lack of protective measures for the SQL query structure. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Hibernate query service implementation in the Kaiten project management tool is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of th...

JetBrains YouTrack Access Control Error Vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. JetBrains YouTrack suffers from an Access Control Error vulnerability that stems from a lack...

CVE-2025-48070

Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site...

CVE-2025-22606

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes...

CVE-2025-0213

A vulnerability was found in Campcodes Project Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forms/updateforms.php?action=changepic2=4. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated...

CVE-2025-0336

A vulnerability was found in Codezips Project Management System 1.0. It has been classified as critical. This affects an unknown part of the file /pages/forms/teacher.php. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-21616

Plane is an open-source project management tool. A cross-site scripting XSS vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...