Vulnerability GHSA-f679-254h-qhvj
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
1 year ago
February 21, 2025 at 11:54 PM UTC
Leantime allows Cross-Site Scripting (XSS)
2.0 - 3.2.1
2.0 - 3.2.1
Summary
Leantime allows Cross-Site Scripting (XSS)
Details
Summary
There is a cross-site scripting vulnerability on To-Do that affects a title field of a To-Do.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
6 hours ago
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
2.0 - 3.9.8 GHSA-54mm-6729-r5wp
2.0 - 3.9.8 GHSA-54mm-6729-r5wp
Medium Risk
7 months ago
Leantime has HTML injection through firstname and lastname fields
2.0 - 3.3 GHSA-qrfh-cc86-vc8c
2.0 - 3.3 GHSA-qrfh-cc86-vc8c
Medium Risk
1 year ago
Leantime affected by Improper Neutralization of HTML Tags
2.0 - 3.2.1 GHSA-95j3-435g-vjcp
2.0 - 3.2.1 GHSA-95j3-435g-vjcp
Low Risk
1 year ago
Leantime has Missing Authorization Check for Host Parameter
2.0 - 3.2.1 GHSA-3hfj-qcvj-4hx8
2.0 - 3.2.1 GHSA-3hfj-qcvj-4hx8
High Risk
1 year ago
Leantime allows Stored Cross-Site Scripting (XSS)
2.0 - 3.2.1 GHSA-c39w-3pjx-qc7m
2.0 - 3.2.1 GHSA-c39w-3pjx-qc7m
Impacted packages
Timeline
Published
1 year ago
February 21, 2025 at 11:54 PM UTC
Fixed (3.3)
1 year ago
November 16, 2024 at 03:17 PM UTC
Last Modified
1 year ago
February 22, 2025 at 12:25 AM UTC