Advisories · Technology
leantime.
Every CVE that names leantime among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX
- leantime
- Broken access control
- CVSS 8.1 High
Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass
- Leantime
- Broken access control
- CVSS 8.6 High
Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware
- Leantime
- Cross-site request forgery (CSRF)
- CVSS 8.4 High
Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()
- Leantime
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Leantime Open Redirect in Login Controller via redirectUrl Parameter
- Leantime
- Open redirect
- CVSS 7.1 High
Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC
- Leantime
- Broken access control
- CVSS 5.3 Medium
Leantime API saveSetting improper authorization
- Leantime
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
Leantime JSON-RPC Endpoint addUser improper authorization
- Leantime
- Privilege escalation
- Broken access control
- CVSS 8.6 High
Leantime - JSON-RPC API Broken Access Control via users.getUser
- Leantime
- Broken access control
- CVSS 8.6 High
Leantime - OIDC Login CSRF via Unconditional State Verification Stub
- Leantime
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
Authenticated SQL Injection in leantime
- leantime
- SQL injection
- CVSS 8.9 High
Leantime Stored Cross-site Scripting Vulnerability
- leantime
- Cross-site scripting (XSS)
- CVSS 8.7 High
Time-based blind injection in Leantime
- Leantime
- SQL injection