Vulnerability GHSA-95j3-435g-vjcp
Medium Risk
MEDIUM RISK
CVSS Score: 6.5
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 year ago
February 21, 2025 at 11:54 PM UTC
Leantime affected by Improper Neutralization of HTML Tags
2.0 - 3.2.1
2.0 - 3.2.1
Summary
Leantime affected by Improper Neutralization of HTML Tags
Details
Summary
HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
6 hours ago
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
2.0 - 3.9.8 GHSA-54mm-6729-r5wp
2.0 - 3.9.8 GHSA-54mm-6729-r5wp
Medium Risk
7 months ago
Leantime has HTML injection through firstname and lastname fields
2.0 - 3.3 GHSA-qrfh-cc86-vc8c
2.0 - 3.3 GHSA-qrfh-cc86-vc8c
Low Risk
1 year ago
Leantime allows Cross-Site Scripting (XSS)
2.0 - 3.2.1 GHSA-f679-254h-qhvj
2.0 - 3.2.1 GHSA-f679-254h-qhvj
Low Risk
1 year ago
Leantime has Missing Authorization Check for Host Parameter
2.0 - 3.2.1 GHSA-3hfj-qcvj-4hx8
2.0 - 3.2.1 GHSA-3hfj-qcvj-4hx8
High Risk
1 year ago
Leantime allows Stored Cross-Site Scripting (XSS)
2.0 - 3.2.1 GHSA-c39w-3pjx-qc7m
2.0 - 3.2.1 GHSA-c39w-3pjx-qc7m
Impacted packages
Timeline
Published
1 year ago
February 21, 2025 at 11:54 PM UTC
Fixed (3.3)
1 year ago
November 16, 2024 at 03:17 PM UTC
Last Modified
1 year ago
March 31, 2025 at 04:59 PM UTC