Openproject vulnerabilities

Products

• Openproject 37

Newest

• openproject OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup CVE-2026-40896 6.5 MediumApril 20, 2026
• openproject OpenProject: 2FA OTP Verification Missing Rate Limiting CVE-2026-33667 7.4 HighApril 15, 2026
• openproject OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string CVE-2026-34717 Public exploit 9.9 CriticalApril 2, 2026
• openproject OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy CVE-2026-32703 9.1 CriticalMarch 18, 2026
• openproject OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution CVE-2026-32698 9.1 CriticalMarch 18, 2026
• openproject Blind SSRF on OpenProject instance via webhooks CVE-2026-31974 3.0 LowMarch 11, 2026
• openproject OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets CVE-2026-30239 6.5 MediumMarch 11, 2026
• openproject OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate CVE-2026-30236 4.3 MediumMarch 11, 2026
• openproject Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering CVE-2026-30235 6.5 MediumMarch 11, 2026
• openproject OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR) CVE-2026-30234 6.5 MediumMarch 11, 2026
• openproject OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects CVE-2026-27723 4.3 MediumMarch 5, 2026
• openproject OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts CVE-2026-24777 6.7 MediumFebruary 9, 2026
• openproject Command Injection on OpenProject repositories leads to Remote Code Execution CVE-2026-25763 9.4 CriticalFebruary 6, 2026
• openproject OpenProject vulnerable to Stored HTML injection CVE-2026-25764 3.5 LowFebruary 6, 2026
• openproject OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer CVE-2026-24776 4.3 MediumFebruary 6, 2026
• openproject OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension CVE-2026-24775 6.3 MediumJanuary 28, 2026
• openproject OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server CVE-2026-24772 8.9 HighJanuary 28, 2026
• openproject OpenProject has Argument Injection on Repository module that allows Arbitrary File Write CVE-2026-24685 9.4 CriticalJanuary 28, 2026
• openproject OpenProject users with "View Members" permission in any project can view all Group memberships CVE-2026-23721 4.3 MediumJanuary 19, 2026
• openproject OpenProject users can delete other user's session, causing them to be logged out CVE-2026-23646 6.5 MediumJanuary 19, 2026
• openproject OpenProject has stored XSS regression using attachments and script-src self CVE-2026-23625 8.7 HighJanuary 19, 2026
• openproject OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings CVE-2026-22605 4.3 MediumJanuary 10, 2026
• openproject OpenProject is vulnerable to user enumeration via the change password function CVE-2026-22604 6.9 MediumJanuary 10, 2026
• openproject OpenProject has no protection against brute-force attacks in the Change Password function CVE-2026-22603 6.9 MediumJanuary 10, 2026
• openproject OpenProject is Vulnerable to User Enumeration via User ID CVE-2026-22602 3.5 LowJanuary 10, 2026
• openproject OpenProject is Vulnerable to Code Execution in E-Mail function CVE-2026-22601 8.6 HighJanuary 10, 2026
• openproject OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder CVE-2026-22600 9.1 CriticalJanuary 10, 2026
• openproject OpenProject stored HTML injection vulnerability CVE-2025-24892 3.5 LowFebruary 10, 2025
• openproject OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration CVE-2024-41801 4.7 MediumJuly 25, 2024
• openproject Stored Cross-Site Scripting (XSS) in OpenProject CVE-2024-35224 7.6 HighMay 23, 2024
• openproject OpenProject vulnerable to project identifier information leakage through robots.txt CVE-2023-33960 Fix available 7.5 HighJune 1, 2023
• openproject OpenProject user sessions not terminated after activation of 2FA CVE-2023-31140 Fix available 4.8 MediumMay 8, 2023
• openproject SQL injection in OpenProject CVE-2021-43830 7.4 HighDecember 14, 2021
• openproject Regular Expression Denial of Service in OpenProject forum messages CVE-2021-32763 4.3 MediumJuly 20, 2021
• openproject An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows... CVE-2019-17092 6.1 MediumOctober 9, 2019
• openproject A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote... CVE-2019-11600 Public exploit EPSS 80.0% 8.1 HighMay 13, 2019
• openproject OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote... CVE-2017-11667 8.1 HighJuly 26, 2017