Skip to content
OpenAdvisories

Package · Packagist

leantime/leantime

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-85990

    Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

    Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, …

    Leantime Leantime leantime/leantime Packagist
  • High —
    GHSA-c39w-3pjx-qc7m

    Leantime allows Stored Cross-Site Scripting (XSS)

    ### Description Leantime allows stored cross-site scripting (XSS) in the API key name while generating the API key. ### Impact Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the…

    leantime/leantime Packagist
  • High —
    GHSA-v4q9-437p-mhpg

    Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)

    ### Summary A cross-site scripting (XSS) vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user…

    leantime/leantime Packagist