Alanaktion Phproject vulnerabilities

• alanaktion phproject Phproject < 1.8.7 Missing Authorization via Issues REST API CVE-2026-104991 Public exploit 7.1 HighOctober 2, 2026
• alanaktion phproject Stored XSS in “hours” fields when creating or editing an issue, using SQLite database CVE-2025-57768 6.9 MediumAugust 21, 2025
• alanaktion phproject RCE via file upload in Phproject CVE-2020-11011 9.9 CriticalApril 22, 2020