CVE-2026-103491

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...

CVE-2026-103491

JetBrains YouTrack versions prior to 2026.2.19422 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw within the issue activities API . This vulnerability allows an attacker to read restricted issues that they should not have access to. The base CVSS score is 6.5 (MEDIUM) , indicati...

EUVD-2026-90582

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...

CVE-2026-103491

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...

CVE-2019-11600

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access...

CVE-2019-11600

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access...

Sql injection

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access...

CVE-2019-11600

CVE-2019-11600 is an SQL injection in OpenProject’s activities API, exploitable via the id parameter. Affected product: OpenProject versions 5.0.0 through 8.3.1; the vulnerability can be exploited remotely and, in some configurations, unauthenticated if API access is not protected. Consequences s...

CVE-2019-11600

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access...

CVE-2019-11600: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access...