Leantime 3.0.6
Approved changes feed: RSS · Atom
cpe:2.3:a:leantime:leantime:3.0.6:*:*:*:*:*:*:*part: a version: 3.0.6 update: *
| Vendor | Leantime (f44fc121-159b-532f-84b2-e234f4bd5157) |
|---|---|
| Product | Leantime (100b0bb9-7c2f-5cdf-b08d-29c5701bd68f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/leantime/leantime |
purl2cpe | 2026-06-01 10:12:06.764883 |
pkg:github/leantime/leantime |
purl2cpe | 2026-06-01 10:12:06.764884 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-27705 |
vulnerable | 2026-06-08 06:31:29.117182 |
Details available
Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files/browse endpoint.
Published: 2024-04-03T00:00:00.000Z
Updated: 2024-08-28T18:48:45.470Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-27703 |
vulnerable | 2026-06-08 06:31:29.115189 |
Details available
Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter.
Published: 2024-03-13T00:00:00.000Z
Updated: 2024-08-27T18:32:24.776Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-27477 |
vulnerable | 2026-06-08 06:31:28.989636 |
Details available
In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS vulnerability can be exploited to perform Server-Side Request Forgery (SSRF) attacks.
Published: 2024-04-10T00:00:00.000Z
Updated: 2024-11-06T15:57:33.528Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-27476 |
vulnerable | 2026-06-08 06:31:28.989116 |
Details available
Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket.
Published: 2024-04-10T00:00:00.000Z
Updated: 2024-08-02T00:34:52.312Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-27474 |
vulnerable | 2026-06-08 06:31:28.988553 |
Details available
Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators.
Published: 2024-04-10T00:00:00.000Z
Updated: 2024-08-21T20:18:30.064Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.