Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via omission of the VerifyCsrfToken middleware in the global middleware stack. An attacker can perform unauthorized actions on behalf of authenticated users by tricking them into visiting a malicious...

CVE-2026-66416 Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

EUVD-2026-51245

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...

PT-2026-66545

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An issue exists where the Laravel VerifyCsrfToken middleware is excluded from the global middleware stack in app/Http/Kernel.php. This allows unauthenticated attackers to perform state-changing actions on...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the saveSetting function of the API component. An attacker can gain unauthorized access to sensitive information or modify application settings by sending crafted API requests with insufficient authorization...

EUVD-2020-26486

Malware in sbrugna...

EUVD-2025-4460

Malicious code in bioql PyPI...

EUVD-2025-4465

Malicious code in bioql PyPI...

EUVD-2025-4470

Malicious code in bioql PyPI...

EUVD-2025-4471

Malicious code in bioql PyPI...

EUVD-2025-4464

Malicious code in bioql PyPI...

EUVD-2025-4468

Malicious code in bioql PyPI...

EUVD-2025-8662

Malicious code in bioql PyPI...

CVE-2024-27474

Leantime 3.0.6 is vulnerable to Cross Site Request Forgery CSRF. This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators...

CVE-2024-27476

Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show/tickets/newTicket...

CVE-2025-28254

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions...

Duplicate Advisory: Leantime affected by Improper Neutralization of HTML Tags

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-95j3-435g-vjcp. This link is maintained to preserve external references. Original Description Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrar...

GHSA-JF6P-4HGV-V6QH Duplicate Advisory: Leantime affected by Improper Neutralization of HTML Tags

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-95j3-435g-vjcp. This link is maintained to preserve external references. Original Description Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrar...

CVE-2025-28254

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions...

CVE-2025-28254

The project management system Leantime (v3.2.1 and before) is vulnerable to Cross-Site Scripting (XSS) via the first name field within the processMentions() method. This vulnerability arises from the improper neutralization of input , allowing an authenticated attacker to inject arbitrary HTML or...