CVE-2023-33960 OpenProject vulnerable to project identifier information leakage through robots.txt

OpenProject is web-based project management software. For any OpenProject installation, a robots.txt file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to...

CVE-2023-33961

Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Javascript into a comment. Once the malicious comment is loaded in the browser by a user, the malicious Javascript code executes. As of time ...

Code injection

Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Javascript into a comment. Once the malicious comment is loaded in the browser by a user, the malicious Javascript code executes. As of time ...

CVE-2023-33961

Leantime (v2.3.21 and later) is affected by a stored cross-site scripting vulnerability. An authenticated user with commenting privileges can inject malicious JavaScript into a comment, which executes in other users’ browsers when the comment is viewed. The available documents state that a patch ...

CVE-2023-33961 Leantime Stored Cross-site Scripting Vulnerability

Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Javascript into a comment. Once the malicious comment is loaded in the browser by a user, the malicious Javascript code executes. As of time ...

CVE-2023-32685

Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the contentEditable element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document...

CVE-2023-32685

Kanboard (Kanban project management) contains a clipboard-based XSS flaw tracked as CVE-2023-32685. The root cause is improper handling of elements under contentEditable, enabling a low-privileged attacker with document-attachment permission to inject arbitrary HTML via malicious clipboard conten...

CVE-2023-32685 Clipboard based cross-site scripting (blocked with default CSP) in Kanboard

Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the contentEditable element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document...

CVE-2023-32685 Clipboard based cross-site scripting (blocked with default CSP) in Kanboard

Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the contentEditable element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document...

Leantime Systems Leantime 跨站脚本漏洞

Leantime Systems Leantime is an open source project management system based on PHP and MySQL from Leantime Systems. A security vulnerability exists in Leantime 2.3.21 and later versions, which can be exploited by users with comment privileges to inject malicious Javascript into a comment, which c...

WordPress Plugin Panorama – WordPress Project Management 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. WordPress Plugin Panorama - A cross-site...

aspirepm.co.uk Cross Site Scripting vulnerability OBB-3295692

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ProjeQtOr Project Management System 10.3.2 Shell Upload

Exploit Title: ProjeQtOr Project Management System 10.3.2 -Remote Code Execution RCE Application: ProjeQtOr Project Management System Version: 10.3.2 Bugs: Remote Code Execution RCE Authenticated via file upload Technology: PHP Vendor URL: https://www.projeqtor.org Software Link:...

CVE-2023-1725

Server-Side Request Forgery SSRF vulnerability in Infoline Project Management System allows Server Side Request Forgery. This issue affects Project Management System: before 4.09.31.125...

CVE-2023-1725

Server-Side Request Forgery SSRF vulnerability in Infoline Project Management System allows Server Side Request Forgery. This issue affects Project Management System: before 4.09.31.125...

CVE-2023-1725

Server-Side Request Forgery SSRF vulnerability in Infoline Project Management System allows Server Side Request Forgery.This issue affects Project Management System: before 4.09.31.125...

CVE-2023-1725 SSRF in Infoline Project Management System

Server-Side Request Forgery SSRF vulnerability in Infoline Project Management System allows Server Side Request Forgery. This issue affects Project Management System: before 4.09.31.125...

CVE-2023-1725 SSRF in Infoline Project Management System

Server-Side Request Forgery SSRF vulnerability in Infoline Project Management System allows Server Side Request Forgery. This issue affects Project Management System: before 4.09.31.125...

CVE-2023-1725

CVE-2023-1725 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Infoline Project Management System prior to version 4.09.31.125. The issue is documented across multiple sources in the connected set, consistently identifying SSRF as the underlying weakness in this product/version...

Infoline Project Management System 代码问题漏洞

Infoline Project Management System is a project management system from Infoline. A code issue vulnerability exists in Infoline Project Management System versions prior to 4.09.31.125. An attacker could exploit this vulnerability to perform a server-side request forgery attack...