leantime/leantime
Leantime is a goals focused project management system for non-project managers. Building with ADHD, Autism, and dyslexia in mind.
View on Github
Activity
- Latest release
- 2mo ago
- Total releases
- 146
- Cadence
- ~5 days
- Last 12 months
- 17
Reach
- Stars
- 11.2k
Details
- License
- unknown
- First release
- Sep 28, 2019
| Version | Released | |
|---|---|---|
v3.9.8
patch
|
v3.9.8
patch
Dependencies (52)
+ 44 more
Changelog
Compare changes
|
|
v3.9.7
patch
| ||
v3.9.6
patch
|
v3.9.6
patch
Dependencies (53)
+ 45 more
Changelog
Compare changes
|
|
v3.9.5
patch
| ||
v3.9.4
patch
|
v3.9.4
patch
Dependencies (52)
+ 44 more
Changelog
Compare changes
|
|
v3.9.3
patch
| ||
v3.9.2
patch
| ||
v3.9.1
patch
| ||
v3.9.0
minor
| ||
v3.8.0
minor
| ||
v3.7.3
patch
| ||
v3.7.2
patch
| ||
v3.7.1
patch
| ||
v3.7.0
minor
| ||
v3.6.2
patch
| ||
v3.6.1
patch
| ||
v3.6.0
minor
| ||
v3.5.12
patch
| ||
v3.5.11
patch
| ||
v3.5.10
patch
| ||
v3.5.9
patch
| ||
v3.5.8
patch
|
v3.5.8
patch
Dependencies (52)
+ 44 more
Changelog
Compare changes
|
|
v3.5.7
patch
| ||
v3.5.6
patch
|
v3.5.6
patch
Dependencies (51)
+ 43 more
Changelog
Compare changes
|
|
v3.5.5
patch
|
v3.5.5
patch
Dependencies (51)
+ 43 more
Changelog
Compare changes
|
|
v3.5.4
patch
| ||
v3.5.3
patch
|
v3.5.3
patch
Dependencies (47)
+ 39 more
Changelog
Compare changes
|
|
v3.5.2
patch
| ||
v3.5.1
minor
| ||
v3.4.12
patch
|
v3.4.12
patch
Dependencies (46)
+ 38 more
Changelog
Compare changes
|
|
v3.4.11
patch
|
v3.4.11
patch
Dependencies (43)
+ 35 more
Changelog
Compare changes
|
|
v3.4.10
patch
| ||
v3.4.9
patch
| ||
v3.4.8
patch
| ||
v3.4.7
patch
| ||
v3.4.6
patch
| ||
v3.4.5
patch
| ||
v3.4.4
patch
| ||
v3.4.3
patch
|
v3.4.3
patch
Dependencies (60)
+ 52 more
Changelog
Compare changes
|
|
v3.4.2
patch
| ||
v3.4.1
patch
| ||
3.4.0
minor
|
3.4.0
minor
Dependencies (60)
+ 52 more
Changelog
Compare changes
|
|
3.3.3
patch
|
3.3.3
patch
Dependencies (41)
+ 33 more
Changelog
Compare changes
|
|
3.3.2
patch
|
3.3.2
patch
Dependencies (42)
+ 34 more
Changelog
Compare changes
|
|
3.3.1
patch
| ||
3.3
minor
1 CVE
GHSA-qrfh-cc86-vc8c
Mar 05, 2026
Leantime has HTML injection through firstname and lastname fields
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryLeantime v2.3.27 is vulnerable to Stored HTML Injection. The Vulnerable File
Vulnerable Code (Lines ~14-17)These fields output raw user input without sanitization. Steps to Reproduce
FixReplace unescaped Or use the existing Impact
Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 89 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
3.3
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3.0
References Updated Mar 05, 2026 · Source: OSV.dev | ||
3.2.1
patch
9 CVEs
GHSA-qrfh-cc86-vc8c
Mar 05, 2026
Leantime has HTML injection through firstname and lastname fields
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryLeantime v2.3.27 is vulnerable to Stored HTML Injection. The Vulnerable File
Vulnerable Code (Lines ~14-17)These fields output raw user input without sanitization. Steps to Reproduce
FixReplace unescaped Or use the existing Impact
Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 89 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
3.3
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3.0
References Updated Mar 05, 2026 · Source: OSV.dev
GHSA-f679-254h-qhvj
Feb 21, 2025
Leantime allows Cross-Site Scripting (XSS)
Low
Network
Low
Low
SummaryThere is a cross-site scripting vulnerability on To-Do that affects a title field of a To-Do. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 22, 2025 · Source: OSV.dev
CVE-2025-28254
GHSA-95j3-435g-vjcp
Feb 21, 2025
Leantime affected by Improper Neutralization of HTML Tags
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
SummaryHTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References
Updated Mar 31, 2025 · Source: OSV.dev
GHSA-3hfj-qcvj-4hx8
Feb 21, 2025
Leantime has Missing Authorization Check for Host Parameter
Low
Network
Low
Low
None
Finding DescriptionApplication has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. ImpactBy exploiting this vulnerability an attacker can able to view profile information (but not anything else or change anything) Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 22, 2025 · Source: OSV.dev
GHSA-c39w-3pjx-qc7m
Feb 21, 2025
Leantime allows Stored Cross-Site Scripting (XSS)
High
Network
Low
Low
None
DescriptionLeantime allows stored cross-site scripting (XSS) in the API key name while generating the API key. ImpactAny low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-v4q9-437p-mhpg
Feb 21, 2025
Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)
High
Network
Low
Low
SummaryA cross-site scripting (XSS) vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user-sensitive information. The code does not include any validation or sanitization of the $_GET["id"] parameter. As a result, it directly incorporates the user-supplied value into the source path without any checks. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-52xf-h226-pfgx
Feb 21, 2025
Leantime allows Refelected Cross-Site Scripting (XSS)
Medium
Network
Low
Low
SummaryThe vulnerability in Leantime's "overdue" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauthorized actions. Improving input validation and output encoding in the file upload process can prevent this exploit. Accessing and enhancing the relevant source code modules is crucial for addressing this security flaw effectively. ImpactThis XSS vulnerability allows attackers to inject malicious scripts into the Leantime application, compromising user data, session tokens, and potentially executing unauthorized actions on behalf of users. Exploitation could lead to account takeover, data theft, and unauthorized access to sensitive information, posing a significant risk to user privacy, data integrity, and system security. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-h6w8-27ph-c385
Feb 21, 2025
Leantime has Insufficiently Protected Credentials
Medium
Network
Low
Low
Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore. Additional Information: Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-mg4c-884j-pcq9
Feb 21, 2025
Leantime allows Stored Cross-Site Scripting (XSS)
Medium
Network
Low
Low
STORED XSS +OPEN REDIRECTION in SVG uploads Vulnerable url:https://hack.leantime.io/projects/showProject/3 Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev |
3.2.1
patch
Dependencies (42)
+ 34 more
Changelog
Compare changes
|
|
3.2.0
minor
9 CVEs
GHSA-qrfh-cc86-vc8c
Mar 05, 2026
Leantime has HTML injection through firstname and lastname fields
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryLeantime v2.3.27 is vulnerable to Stored HTML Injection. The Vulnerable File
Vulnerable Code (Lines ~14-17)These fields output raw user input without sanitization. Steps to Reproduce
FixReplace unescaped Or use the existing Impact
Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 89 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
3.3
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3.0
References Updated Mar 05, 2026 · Source: OSV.dev
GHSA-f679-254h-qhvj
Feb 21, 2025
Leantime allows Cross-Site Scripting (XSS)
Low
Network
Low
Low
SummaryThere is a cross-site scripting vulnerability on To-Do that affects a title field of a To-Do. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 22, 2025 · Source: OSV.dev
CVE-2025-28254
GHSA-95j3-435g-vjcp
Feb 21, 2025
Leantime affected by Improper Neutralization of HTML Tags
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
SummaryHTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References
Updated Mar 31, 2025 · Source: OSV.dev
GHSA-3hfj-qcvj-4hx8
Feb 21, 2025
Leantime has Missing Authorization Check for Host Parameter
Low
Network
Low
Low
None
Finding DescriptionApplication has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. ImpactBy exploiting this vulnerability an attacker can able to view profile information (but not anything else or change anything) Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 22, 2025 · Source: OSV.dev
GHSA-c39w-3pjx-qc7m
Feb 21, 2025
Leantime allows Stored Cross-Site Scripting (XSS)
High
Network
Low
Low
None
DescriptionLeantime allows stored cross-site scripting (XSS) in the API key name while generating the API key. ImpactAny low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-v4q9-437p-mhpg
Feb 21, 2025
Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)
High
Network
Low
Low
SummaryA cross-site scripting (XSS) vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user-sensitive information. The code does not include any validation or sanitization of the $_GET["id"] parameter. As a result, it directly incorporates the user-supplied value into the source path without any checks. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-52xf-h226-pfgx
Feb 21, 2025
Leantime allows Refelected Cross-Site Scripting (XSS)
Medium
Network
Low
Low
SummaryThe vulnerability in Leantime's "overdue" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauthorized actions. Improving input validation and output encoding in the file upload process can prevent this exploit. Accessing and enhancing the relevant source code modules is crucial for addressing this security flaw effectively. ImpactThis XSS vulnerability allows attackers to inject malicious scripts into the Leantime application, compromising user data, session tokens, and potentially executing unauthorized actions on behalf of users. Exploitation could lead to account takeover, data theft, and unauthorized access to sensitive information, posing a significant risk to user privacy, data integrity, and system security. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-h6w8-27ph-c385
Feb 21, 2025
Leantime has Insufficiently Protected Credentials
Medium
Network
Low
Low
Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore. Additional Information: Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-mg4c-884j-pcq9
Feb 21, 2025
Leantime allows Stored Cross-Site Scripting (XSS)
Medium
Network
Low
Low
STORED XSS +OPEN REDIRECTION in SVG uploads Vulnerable url:https://hack.leantime.io/projects/showProject/3 Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev |
3.2.0
minor
Dependencies (42)
+ 34 more
Changelog
Compare changes
|
|
3.2.0-beta-2
pre
9 CVEs
GHSA-qrfh-cc86-vc8c
Mar 05, 2026
Leantime has HTML injection through firstname and lastname fields
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryLeantime v2.3.27 is vulnerable to Stored HTML Injection. The Vulnerable File
Vulnerable Code (Lines ~14-17)These fields output raw user input without sanitization. Steps to Reproduce
FixReplace unescaped Or use the existing Impact
Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 89 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
3.3
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3.0
References Updated Mar 05, 2026 · Source: OSV.dev
GHSA-f679-254h-qhvj
Feb 21, 2025
Leantime allows Cross-Site Scripting (XSS)
Low
Network
Low
Low
SummaryThere is a cross-site scripting vulnerability on To-Do that affects a title field of a To-Do. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 22, 2025 · Source: OSV.dev
CVE-2025-28254
GHSA-95j3-435g-vjcp
Feb 21, 2025
Leantime affected by Improper Neutralization of HTML Tags
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
SummaryHTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References
Updated Mar 31, 2025 · Source: OSV.dev
GHSA-3hfj-qcvj-4hx8
Feb 21, 2025
Leantime has Missing Authorization Check for Host Parameter
Low
Network
Low
Low
None
Finding DescriptionApplication has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. ImpactBy exploiting this vulnerability an attacker can able to view profile information (but not anything else or change anything) Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 22, 2025 · Source: OSV.dev
GHSA-c39w-3pjx-qc7m
Feb 21, 2025
Leantime allows Stored Cross-Site Scripting (XSS)
High
Network
Low
Low
None
DescriptionLeantime allows stored cross-site scripting (XSS) in the API key name while generating the API key. ImpactAny low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-v4q9-437p-mhpg
Feb 21, 2025
Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)
High
Network
Low
Low
SummaryA cross-site scripting (XSS) vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user-sensitive information. The code does not include any validation or sanitization of the $_GET["id"] parameter. As a result, it directly incorporates the user-supplied value into the source path without any checks. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-52xf-h226-pfgx
Feb 21, 2025
Leantime allows Refelected Cross-Site Scripting (XSS)
Medium
Network
Low
Low
SummaryThe vulnerability in Leantime's "overdue" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauthorized actions. Improving input validation and output encoding in the file upload process can prevent this exploit. Accessing and enhancing the relevant source code modules is crucial for addressing this security flaw effectively. ImpactThis XSS vulnerability allows attackers to inject malicious scripts into the Leantime application, compromising user data, session tokens, and potentially executing unauthorized actions on behalf of users. Exploitation could lead to account takeover, data theft, and unauthorized access to sensitive information, posing a significant risk to user privacy, data integrity, and system security. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-h6w8-27ph-c385
Feb 21, 2025
Leantime has Insufficiently Protected Credentials
Medium
Network
Low
Low
Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore. Additional Information: Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-mg4c-884j-pcq9
Feb 21, 2025
Leantime allows Stored Cross-Site Scripting (XSS)
Medium
Network
Low
Low
STORED XSS +OPEN REDIRECTION in SVG uploads Vulnerable url:https://hack.leantime.io/projects/showProject/3 Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev |
3.2.0-beta-2
pre
Dependencies (38)
+ 30 more
Changelog
Compare changes
|
|
3.2.0-beta
pre
9 CVEs
GHSA-qrfh-cc86-vc8c
Mar 05, 2026
Leantime has HTML injection through firstname and lastname fields
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryLeantime v2.3.27 is vulnerable to Stored HTML Injection. The Vulnerable File
Vulnerable Code (Lines ~14-17)These fields output raw user input without sanitization. Steps to Reproduce
FixReplace unescaped Or use the existing Impact
Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 89 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
3.3
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3.0
References Updated Mar 05, 2026 · Source: OSV.dev
GHSA-f679-254h-qhvj
Feb 21, 2025
Leantime allows Cross-Site Scripting (XSS)
Low
Network
Low
Low
SummaryThere is a cross-site scripting vulnerability on To-Do that affects a title field of a To-Do. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 22, 2025 · Source: OSV.dev
CVE-2025-28254
GHSA-95j3-435g-vjcp
Feb 21, 2025
Leantime affected by Improper Neutralization of HTML Tags
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
SummaryHTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References
Updated Mar 31, 2025 · Source: OSV.dev
GHSA-3hfj-qcvj-4hx8
Feb 21, 2025
Leantime has Missing Authorization Check for Host Parameter
Low
Network
Low
Low
None
Finding DescriptionApplication has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. ImpactBy exploiting this vulnerability an attacker can able to view profile information (but not anything else or change anything) Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 22, 2025 · Source: OSV.dev
GHSA-c39w-3pjx-qc7m
Feb 21, 2025
Leantime allows Stored Cross-Site Scripting (XSS)
High
Network
Low
Low
None
DescriptionLeantime allows stored cross-site scripting (XSS) in the API key name while generating the API key. ImpactAny low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-v4q9-437p-mhpg
Feb 21, 2025
Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)
High
Network
Low
Low
SummaryA cross-site scripting (XSS) vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user-sensitive information. The code does not include any validation or sanitization of the $_GET["id"] parameter. As a result, it directly incorporates the user-supplied value into the source path without any checks. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-52xf-h226-pfgx
Feb 21, 2025
Leantime allows Refelected Cross-Site Scripting (XSS)
Medium
Network
Low
Low
SummaryThe vulnerability in Leantime's "overdue" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauthorized actions. Improving input validation and output encoding in the file upload process can prevent this exploit. Accessing and enhancing the relevant source code modules is crucial for addressing this security flaw effectively. ImpactThis XSS vulnerability allows attackers to inject malicious scripts into the Leantime application, compromising user data, session tokens, and potentially executing unauthorized actions on behalf of users. Exploitation could lead to account takeover, data theft, and unauthorized access to sensitive information, posing a significant risk to user privacy, data integrity, and system security. Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-h6w8-27ph-c385
Feb 21, 2025
Leantime has Insufficiently Protected Credentials
Medium
Network
Low
Low
Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore. Additional Information: Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev
GHSA-mg4c-884j-pcq9
Feb 21, 2025
Leantime allows Stored Cross-Site Scripting (XSS)
Medium
Network
Low
Low
STORED XSS +OPEN REDIRECTION in SVG uploads Vulnerable url:https://hack.leantime.io/projects/showProject/3 Affected versions
2.4
2.4-beta
2.4-beta-7
2.4-beta-8
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.7
2.4.8
3.0.0
+ 88 more Show less
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.2.0-beta
3.2.0-beta-2
3.2.1
v2.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1
v2.1-beta
v2.1-beta2
v2.1-beta3
v2.1-beta5
v2.1-beta6
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0-beta
v2.3.1-beta
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.18
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
Fixed in
3.3
References Updated Feb 21, 2025 · Source: OSV.dev |