Advisories · Technology
Kanboard.
Every CVE that names Kanboard among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.4 High
Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation
- Kanboard
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop
- kanboard
- Broken access control
- CVSS 5.3 Medium
Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID
- kanboard
- Broken access control
- CVSS 8.4 High
Kanboard has Authenticated SQL Injection in Project Permissions Handler
- kanboard
- SQL injection
- CVSS 7.0 High
Kanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become admin
- kanboard
- Broken access control
- CVSS 4.3 Medium
Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects
- kanboard
- Broken access control
- CVSS 8.5 High
Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCE
- kanboard
- Broken access control
- CVSS 4.3 Medium
Kanboard is missing authorization check in getSwimlane API allows cross-project data access
- kanboard
- Broken access control
- CVSS 5.7 Medium
Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment
- kanboard
- Cross-site request forgery (CSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Kanboard is Vulnerable to Reverse Proxy Authentication Bypass
- kanboard
- Authentication bypass
- CVSS 5.3 Medium
Kanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information Disclosure
- kanboard
- Other injection
- Information disclosure
- CVSS 4.7 Medium
Kanboard vulnerable to Open Redirect via protocol-relative URLs
- kanboard
- Open redirect
- CVSS 9.1 CriticalCritical · CVSS 9+
Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events
- kanboard
- Insecure deserialization
- CVSS 6.4 Medium
Kanboard Path Traversal in File Write via Task File Upload Api
- kanboard
- Path traversal
- CVSS 5.3 Medium
Kanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection Bypass
- kanboard
- Information disclosure
- CVSS 8.1 High
Kanboard Password Reset Poisoning via Host Header Injection
- kanboard
- CWE-640
- CVSS 1.3 Low
Kanboard has stored Cross-site Scripting vulnerability in project name
- kanboard
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Insufficient session invalidation in Kanboard
- kanboard
- Authentication bypass
- CVSS 5.5 Medium
Kanboard allows a persistent HTML injection site scripting in settings page date format
- kanboard
- Cross-site scripting (XSS)
- CVSS 9.1 CriticalCritical · CVSS 9+
Arbitrary File Read and Delete in kanboard
- kanboard
- Path traversal
- CWE-27
- CVSS 9.1 CriticalCritical · CVSS 9+
Remote code execution through language setting in kanboard
- kanboard
- Path traversal
- CVSS 8.2 High
Kanboard affected by Project Takeover via IDOR in ProjectPermissionController
- kanboard
- Broken access control
- CVSS 7.1 High
Kanboard Authenticated SQL Injections vulnerability
- kanboard
- SQL injection
- CVSS 6.4 Medium
Stored Cross site scripting in the Task External Link Functionality in Kanboard
- kanboard
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Missing access control in internal task links feature in Kanboard
- kanboard
- Broken access control
- CVSS 5.4 Medium
Missing Access Control allows User to move and duplicate tasks in Kanboard
- kanboard
- Broken access control
- CVSS 4.3 Medium
Parameter based Indirect Object Referencing leading to private file exposure in Kanboard
- kanboard
- Information disclosure
- CVSS 4.4 Medium
Clipboard based cross-site scripting (blocked with default CSP) in Kanboard
- kanboard
- Cross-site scripting (XSS)