CVE-2023-26771

Taskcafe version 0.3.2 is vulnerable to Cross-Site Scripting (XSS) due to a lack of filetype validation during SVG profile picture uploads. An authenticated attacker can exploit this by uploading a malicious SVG file containing an XSS payload, which triggers when a victim opens the file. As a tem...

CVE-2023-26770

The project management tool TaskCafe version 0.3.2 is vulnerable to a lack of validation in the Cookie value . This flaw allows an unauthenticated attacker who knows a registered UserID to change that user's password. As there is currently no information regarding a patched version, it is recomme...

CVE-2020-25400

CVE-2020-25400 affects Taskcafe Project Management tool versions before 0.1.0 and 0.1.1, where cross domain policies allow remote attackers to access sensitive data such as access tokens. The CVE entry indicates a high impact (CVSS3.1 base score 7.5) with network-based, low-complexity access and ...