Leantime vulnerabilities

Products

• Leantime 22

Newest

• leantime Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods CVE-2026-85990 Fix available 8.8 HighOctober 13, 2026
• hyve5 leantime Hyve5 Leantime Project Dashboard show.blade.php cross site scripting CVE-2026-94211 4.8 MediumSeptember 21, 2026
• hyve5 leantime Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting CVE-2026-94210 5.1 MediumSeptember 21, 2026
• leantime Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX CVE-2026-92772 7.1 HighSeptember 16, 2026
• leantime json-rpc api Leantime JSON-RPC API contains a missing authorization vulnerability CVE-2026-76647 8.8 HighAugust 19, 2026
• leantime Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass CVE-2026-54418 8.1 HighAugust 5, 2026
• leantime Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware CVE-2026-66416 8.6 HighJuly 30, 2026
• leantime Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import() CVE-2026-66415 8.4 HighJuly 30, 2026
• leantime Leantime Open Redirect in Login Controller via redirectUrl Parameter CVE-2026-66414 5.1 MediumJuly 30, 2026
• leantime Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC CVE-2026-66412 7.1 HighJuly 27, 2026
• leantime Leantime API saveSetting improper authorization CVE-2026-15510 5.3 MediumJuly 12, 2026
• leantime Leantime JSON-RPC Endpoint addUser improper authorization CVE-2026-15509 5.3 MediumJuly 12, 2026
• leantime Leantime - JSON-RPC API Broken Access Control via users.getUser CVE-2026-59712 8.6 HighJuly 6, 2026
• leantime Leantime - OIDC Login CSRF via Unconditional State Verification Stub CVE-2026-59713 8.6 HighJuly 6, 2026
• leantime Leantime affected by Improper Neutralization of HTML Tags CVE-2025-28254 Fix available 5.4 MediumFebruary 21, 2025
• leantime In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and... CVE-2024-27477 6.1 MediumApril 10, 2024
• leantime Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. CVE-2024-27476 4.7 MediumApril 10, 2024
• leantime Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows... CVE-2024-27474 Public exploit 8.8 HighApril 10, 2024
• leantime Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code... CVE-2024-27705 7.6 HighApril 3, 2024
• leantime Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute... CVE-2024-27703 5.4 MediumMarch 13, 2024
• leantime Authenticated SQL Injection in leantime CVE-2023-45826 6.5 MediumOctober 19, 2023
• leantime Leantime Stored Cross-site Scripting Vulnerability CVE-2023-33961 8.9 HighMay 30, 2023
• leantime Time-based blind injection in Leantime CVE-2020-5292 8.7 HighMarch 31, 2020