Kanboard vulnerabilities

Products

• Kanboard 51

Newest

• kanboard Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation CVE-2026-57862 8.4 HighJuly 30, 2026
• kanboard Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop CVE-2026-58660 7.2 HighJuly 15, 2026
• kanboard Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID CVE-2026-56774 5.3 MediumJune 25, 2026
• kanboard Kanboard has Authenticated SQL Injection in Project Permissions Handler CVE-2026-33058 8.4 HighMarch 18, 2026
• kanboard Kanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become admin CVE-2026-29056 7.0 HighMarch 18, 2026
• kanboard Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects CVE-2026-25531 4.3 MediumFebruary 13, 2026
• kanboard Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCE CVE-2026-25924 Public exploit 8.5 HighFebruary 11, 2026
• kanboard Kanboard is missing authorization check in getSwimlane API allows cross-project data access CVE-2026-25530 4.3 MediumFebruary 10, 2026
• kanboard Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment CVE-2026-24885 5.7 MediumFebruary 10, 2026
• kanboard Kanboard is Vulnerable to Reverse Proxy Authentication Bypass CVE-2026-21881 9.1 CriticalJanuary 8, 2026
• kanboard Kanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information Disclosure CVE-2026-21880 5.3 MediumJanuary 8, 2026
• kanboard Kanboard vulnerable to Open Redirect via protocol-relative URLs CVE-2026-21879 4.7 MediumJanuary 8, 2026
• kanboard Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events CVE-2025-55010 9.1 CriticalAugust 12, 2025
• kanboard Kanboard Path Traversal in File Write via Task File Upload Api CVE-2025-55011 6.4 MediumAugust 12, 2025
• kanboard Kanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection Bypass CVE-2025-52576 5.3 MediumJune 25, 2025
• kanboard Kanboard Password Reset Poisoning via Host Header Injection CVE-2025-52560 8.1 HighJune 24, 2025
• kanboard Kanboard has stored Cross-site Scripting vulnerability in project name CVE-2025-46825 1.3 LowMay 12, 2025
• kanboard Insufficient session invalidation in Kanboard CVE-2024-55603 6.5 MediumDecember 18, 2024
• kanboard Kanboard allows a persistent HTML injection site scripting in settings page date format CVE-2024-54001 5.5 MediumDecember 5, 2024
• kanboard Arbitrary File Read and Delete in kanboard CVE-2024-51747 Public exploit 9.1 CriticalNovember 11, 2024
• kanboard Remote code execution through language setting in kanboard CVE-2024-51748 9.1 CriticalNovember 11, 2024
• kanboard Kanboard affected by Project Takeover via IDOR in ProjectPermissionController CVE-2024-36399 8.2 HighJune 6, 2024
• kanboard Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature. CVE-2024-22720 4.8 MediumJanuary 24, 2024
• kanboard Kanboard Authenticated SQL Injections vulnerability CVE-2023-36813 Fix available 7.1 HighJuly 5, 2023
• kanboard Stored Cross site scripting in the Task External Link Functionality in Kanboard CVE-2023-33969 6.4 MediumJune 5, 2023
• kanboard Missing access control in internal task links feature in Kanboard CVE-2023-33970 5.4 MediumJune 5, 2023
• kanboard Missing Access Control allows User to move and duplicate tasks in Kanboard CVE-2023-33968 5.4 MediumJune 5, 2023
• kanboard Parameter based Indirect Object Referencing leading to private file exposure in Kanboard CVE-2023-33956 4.3 MediumJune 5, 2023
• kanboard Clipboard based cross-site scripting (blocked with default CSP) in Kanboard CVE-2023-32685 4.4 MediumMay 30, 2023
• kanboard app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting. CVE-2019-7324 6.1 MediumFebruary 4, 2019
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the... CVE-2017-15212 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link... CVE-2017-15211 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of... CVE-2017-15210 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments... CVE-2017-15209 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic... CVE-2017-15208 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a... CVE-2017-15207 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link... CVE-2017-15206 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments... CVE-2017-15205 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions... CVE-2017-15204 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories... CVE-2017-15203 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a... CVE-2017-15202 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a... CVE-2017-15201 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a... CVE-2017-15200 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a... CVE-2017-15199 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a... CVE-2017-15198 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to... CVE-2017-15197 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a... CVE-2017-15196 4.3 MediumOctober 10, 2017
• kanboard In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a... CVE-2017-15195 4.3 MediumOctober 10, 2017
• kanboard An authenticated standard user could reset the password of the admin by altering form data.... CVE-2017-12851 8.8 HighAugust 14, 2017
• kanboard An authenticated standard user could reset the password of other users (including the admin) by... CVE-2017-12850 8.8 HighAugust 14, 2017
• Show olderLoading…