57 matches found
CVE-2026-111640
DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...
EUVD-2026-103062
DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...
CVE-2026-111640
DooTask versions through 1.9.66 are vulnerable to a missing authorization flaw in the WebSocketDialog::checkDialog() function. The root cause is a failure to perform membership checks for dialogs with a group_type of 'okr' . Consequently, authenticated users can provide the dialog_id of these OKR...
CVE-2026-111640 DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs
DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...
CVE-2026-111640 DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs
DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...
CVE-2026-111640: Authorization Bypass Through User-Controlled Key
DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...
PT-2026-116039
🚨 CVE-2026-111640 DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with group type 'okr'. Authenticated users can supply the dialog id of OKR comment dialogs to msg list, msg one, or msg send endpoint...
CVE-2026-29828
DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...
EUVD-2026-13730
DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...
CVE-2026-29828
DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...
CVE-2026-29828
DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...
CVE-2026-29828: Improper Neutralization of Input During Web Page Generation
DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...
CVE-2026-29828
DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...
CVE-2026-29828
DooTask v1.6.27 , a task management tool developed by Kuaifan’s individual developers, contains a Cross-Site Scripting (XSS) vulnerability. The flaw exists in the /manage/project/ page due to the improper handling of the projectDesc input field. This vulnerability allows an attacker to execute ma...
PT-2026-26643
CVE-2026-29828 DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/id page via the input field projectDesc. https://t.co/IdJyEMWfTe...
CVE-2026-29828
DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...
DooTask security vulnerabilities
DooTask is a task management tool developed by Kuaifan’s individual developers. Version 1.6.27 of DooTask contains a security vulnerability. This vulnerability stems from improper handling of the projectDesc input field in the /manage/project/ page, which may lead to cross-site scripting attacks...
CVE-2024-34906
An arbitrary file upload vulnerability in dootask v0.30.13 allows attackers to execute arbitrary code via uploading a crafted PDF file...