CVE-2026-66416 Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

EUVD-2026-51245

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...

PT-2026-66545

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An issue exists where the Laravel VerifyCsrfToken middleware is excluded from the global middleware stack in app/Http/Kernel.php. This allows unauthenticated attackers to perform state-changing actions on...

EUVD-2020-26486

Malware in sbrugna...

EUVD-2025-4465

Malicious code in bioql PyPI...

EUVD-2025-4464

Malicious code in bioql PyPI...

EUVD-2025-4470

Malicious code in bioql PyPI...

EUVD-2025-4471

Malicious code in bioql PyPI...

EUVD-2025-8662

Malicious code in bioql PyPI...

EUVD-2025-4460

Malicious code in bioql PyPI...

EUVD-2025-4468

Malicious code in bioql PyPI...

CVE-2024-27474

Leantime 3.0.6 is vulnerable to Cross Site Request Forgery CSRF. This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators...

CVE-2024-27476

Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show/tickets/newTicket...

CVE-2025-28254

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions...

GHSA-JF6P-4HGV-V6QH Duplicate Advisory: Leantime affected by Improper Neutralization of HTML Tags

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-95j3-435g-vjcp. This link is maintained to preserve external references. Original Description Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrar...

Duplicate Advisory: Leantime affected by Improper Neutralization of HTML Tags

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-95j3-435g-vjcp. This link is maintained to preserve external references. Original Description Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrar...

CVE-2025-28254

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions...

CVE-2025-28254

CVE-2025-28254 concerns Leantime v3.2.1 and earlier and describes an authenticated XSS vulnerability triggered by the first name field in processMentions(), potentially allowing arbitrary code execution and access to sensitive information. Affected component: Leantime’s processMentions implementa...

CVE-2025-28254

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions...

CVE-2025-28254

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions...