Redmine vulnerabilities

Products

• Redmine 51
• Pmb 6

Newest

• redmine Stored credentials in Redmine CVE-2026-1836 Fix available 5.3 MediumJune 12, 2026
• redmine pmb PMB 5.6 - 'logid' SQL Injection CVE-2020-37105 7.1 HighFebruary 3, 2026
• redmine pmb PMB 7.4.6 SQL Injection Vulnerability via Unsanitized id Parameter CVE-2023-53982 9.3 CriticalDecember 23, 2025
• redmine pmb In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution. CVE-2025-48744 6.4 MediumMay 27, 2025
• redmine pmb SIGB PMB before 8.0.1.2 allows SQL injection. CVE-2025-48743 5.3 MediumMay 27, 2025
• redmine pmb The installer in SIGB PMB before 8.0.1.2 allows remote code execution. CVE-2025-48742 5.4 MediumMay 27, 2025
• pmb services pmb Remote Code Inclusion Vulnerability in Multiple PMB Versions CVE-2024-26289 9.8 CriticalMay 27, 2024
• redmine Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails. CVE-2023-47260 Fix available 6.1 MediumNovember 5, 2023
• redmine Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter. CVE-2023-47259 Fix available 6.1 MediumNovember 5, 2023
• redmine Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter. CVE-2023-47258 Fix available 6.1 MediumNovember 5, 2023
• redmine Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to... CVE-2022-44637 Fix available 6.1 MediumDecember 12, 2022
• redmine Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to... CVE-2022-44031 Fix available 6.1 MediumDecember 12, 2022
• redmine Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due... CVE-2022-44030 Fix available 7.5 HighDecember 6, 2022
• redmine, debian linux +1 more Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due... CVE-2021-42326 Fix available 5.3 MediumOctober 12, 2021
• redmine Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor... CVE-2021-37156 Fix available 7.5 HighAugust 5, 2021
• redmine, debian linux +1 more Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x... CVE-2021-31863 Fix available 7.5 HighApril 28, 2021
• redmine, debian linux +1 more Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the... CVE-2021-31864 Fix available 5.3 MediumApril 28, 2021
• redmine, debian linux +1 more Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the... CVE-2021-31865 Fix available 5.3 MediumApril 28, 2021
• redmine, debian linux +1 more Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal... CVE-2021-31866 Fix available 5.3 MediumApril 28, 2021
• redmine, debian linux +1 more Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private... CVE-2021-30163 Fix available 7.5 HighApril 6, 2021
• redmine, debian linux +1 more Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field. CVE-2020-36306 Fix available 6.1 MediumApril 6, 2021
• redmine, debian linux +1 more Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links. CVE-2020-36307 Fix available 6.1 MediumApril 6, 2021
• redmine, debian linux +1 more Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non... CVE-2020-36308 Fix available 5.3 MediumApril 6, 2021
• redmine, debian linux +1 more Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting. CVE-2019-25026 Fix available 5.3 MediumApril 6, 2021
• redmine, debian linux +1 more Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes... CVE-2021-30164 Fix available 9.8 CriticalApril 6, 2021
• redmine Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto... CVE-2021-29274 Fix available 6.1 MediumMarch 29, 2021
• redmine, debian linux +1 more A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine... CVE-2019-18890 Public exploitFix available 6.5 MediumNovember 19, 2019
• redmine In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting... CVE-2019-17427 Public exploitFix available 6.1 MediumOctober 10, 2019
• redmine, debian linux +1 more Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and ... CVE-2017-18026 Fix available 8.8 HighJanuary 10, 2018
• redmine, debian linux +1 more In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb... CVE-2017-16804 Fix available 4.3 MediumNovember 13, 2017
• redmine, debian linux +1 more Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows... CVE-2017-15577 Fix available 7.5 HighOctober 18, 2017
• redmine, debian linux +1 more Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views,... CVE-2017-15576 Fix available 7.5 HighOctober 18, 2017
• redmine, debian linux +1 more In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the... CVE-2017-15575 Fix available 7.3 HighOctober 18, 2017
• redmine, debian linux +1 more In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by using an SVG document... CVE-2017-15574 Fix available 6.1 MediumOctober 18, 2017
• redmine, debian linux +1 more In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup is mishandled in wiki... CVE-2017-15573 Fix available 6.1 MediumOctober 18, 2017
• redmine, debian linux +1 more In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information... CVE-2017-15572 Fix available 7.5 HighOctober 18, 2017
• redmine, debian linux +1 more In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views... CVE-2017-15571 Fix available 6.1 MediumOctober 18, 2017
• redmine, debian linux +1 more In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views... CVE-2017-15570 Fix available 6.1 MediumOctober 18, 2017
• redmine, debian linux +1 more In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers... CVE-2017-15569 Fix available 6.1 MediumOctober 18, 2017
• redmine, debian linux +1 more In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers... CVE-2017-15568 Fix available 6.1 MediumOctober 18, 2017
• redmine In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text... CVE-2016-10515 Fix available 6.1 MediumOctober 18, 2017
• redmine Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to... CVE-2015-8477 Fix available 6.1 MediumMay 23, 2017
• redmine, debian linux +1 more app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3... CVE-2015-8537 Fix available 5.3 MediumMarch 23, 2016
• redmine, debian linux +1 more Open redirect vulnerability in the valid_back_url function in app/controllers... CVE-2015-8474 Fix available 7.4 HighMarch 23, 2016
• redmine, debian linux +1 more The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote... CVE-2015-8473 Fix available 4.3 MediumMarch 23, 2016
• redmine, debian linux +1 more app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3... CVE-2015-8346 Fix available 5.3 MediumNovember 26, 2015
• redmine git hosting plugin git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to... CVE-2013-4663 7.5 HighDecember 28, 2014
• redmine Open redirect vulnerability in the redirect_back_or_default function in app/controllers... CVE-2014-1985 Fix available 5.8 MediumApril 11, 2014
• redmine Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's... CVE-2012-2054 Fix available 5.0 MediumApril 4, 2012
• redmine Cross-site scripting (XSS) vulnerability in Redmine before 1.3.2 allows remote attackers to... CVE-2012-0327 Fix available 4.3 MediumApril 4, 2012
• Show olderLoading…