PT-2023-29714

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 2.4-beta-4 Description Leantime is an open source project management system. A userId variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully...

CVE-2023-45826: Improper Neutralization of Special Elements used in an SQL Command

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...