Leantime allows Cross-Site Scripting (XSS)

Summary There is a cross-site scripting vulnerability on To-Do that affects a title field of a To-Do...

GHSA-95J3-435G-VJCP Leantime affected by Improper Neutralization of HTML Tags

Summary HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address...

CVE-2024-27476

Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show/tickets/newTicket...

CVE-2024-27703

Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter...