Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via omission of the VerifyCsrfToken middleware in the global middleware stack. An attacker can perform unauthorized actions on behalf of authenticated users by tricking them into visiting a malicious...

CVE-2026-66416 Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

EUVD-2026-51245

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...

PT-2026-66545

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An issue exists where the Laravel VerifyCsrfToken middleware is excluded from the global middleware stack in app/Http/Kernel.php. This allows unauthenticated attackers to perform state-changing actions on...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the saveSetting function of the API component. An attacker can gain unauthorized access to sensitive information or modify application settings by sending crafted API requests with insufficient authorization...

EUVD-2020-26486

Malware in sbrugna...

EUVD-2025-4465

Malicious code in bioql PyPI...

EUVD-2025-4464

Malicious code in bioql PyPI...

EUVD-2025-4470

Malicious code in bioql PyPI...

EUVD-2025-4471

Malicious code in bioql PyPI...

EUVD-2025-8662

Malicious code in bioql PyPI...

EUVD-2025-4460

Malicious code in bioql PyPI...

EUVD-2025-4468

Malicious code in bioql PyPI...

CVE-2024-27474

Leantime 3.0.6 is vulnerable to Cross Site Request Forgery CSRF. This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators...

CVE-2024-27476

Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show/tickets/newTicket...

CVE-2025-28254

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions...

GHSA-JF6P-4HGV-V6QH Duplicate Advisory: Leantime affected by Improper Neutralization of HTML Tags

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-95j3-435g-vjcp. This link is maintained to preserve external references. Original Description Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrar...

Duplicate Advisory: Leantime affected by Improper Neutralization of HTML Tags

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-95j3-435g-vjcp. This link is maintained to preserve external references. Original Description Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrar...

CVE-2025-28254

Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions...

CVE-2025-28254

A Cross-Site Scripting (XSS) vulnerability exists in Leantime v3.2.1 and earlier versions. The root cause is the improper neutralization of HTML tags within the first name field, specifically during the execution of the processMentions() function. An authenticated attacker can exploit this to exe...