İçeriğe atla
Noroxi

openproject kayıtları

openproject üreticisine ait 37 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
0 · %0
Pre-auth RCE
1
Düzeltme kaydı olan
%43,2
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 17
  2. 19
  3. 21
  4. 23
  5. 24
  6. 25
  7. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

37 kayıt
  • CVE-2019-11600
    56Planlayın

    A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands v

    YüksekCVSS 8,1Kavram kanıtıEPSS %80

    openproject · openproject13 May 2019

  • CVE-2026-25763
    37İzleyin

    Command Injection on OpenProject repositories leads to Remote Code Execution

    KritikCVSS 9,4İstismar yokEPSS %1

    openproject · openproject6 Şub 2026

  • CVE-2026-24685
    37İzleyin

    OpenProject has Argument Injection on Repository module that allows Arbitrary File Write

    KritikCVSS 9,4İstismar yokEPSS %0

    openproject · openproject28 Oca 2026

  • CVE-2026-22600
    36İzleyin

    OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder

    KritikCVSS 9,1İstismar yokEPSS %0

    openproject · openproject9 Oca 2026

  • CVE-2026-24772
    36İzleyin

    OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server

    KritikCVSS 9,0İstismar yokEPSS %0

    openproject · openproject28 Oca 2026

  • CVE-2021-43830
    35İzleyin

    SQL injection in OpenProject

    YüksekCVSS 8,8İstismar yokEPSS %1

    openproject · openproject14 Ara 2021

  • CVE-2026-22601
    34İzleyin

    OpenProject is Vulnerable to Code Execution in E-Mail function

    YüksekCVSS 8,6İstismar yokEPSS %0

    openproject · openproject9 Oca 2026

  • CVE-2017-11667
    32İzleyin

    OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitel

    YüksekCVSS 8,1İstismar yokEPSS %1

    openproject · openproject26 Tem 2017

  • CVE-2026-34717
    32İzleyin

    OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string

    YüksekCVSS 8,1İstismar yokEPSS %0

    openproject · openproject2 Nis 2026

  • CVE-2023-33960
    30İzleyin

    OpenProject vulnerable to project identifier information leakage through robots.txt

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    openproject · openproject1 Haz 2023

  • CVE-2026-33667
    29İzleyin

    OpenProject: 2FA OTP Verification Missing Rate Limiting

    YüksekCVSS 7,4İstismar yokEPSS %0

    openproject · openproject15 Nis 2026

  • CVE-2026-24775
    29İzleyin

    OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension

    YüksekCVSS 7,3İstismar yokEPSS %0

    openproject · openproject28 Oca 2026

  • CVE-2026-32698
    28İzleyin

    OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution

    YüksekCVSS 7,2İstismar yokEPSS %0

    openproject · openproject18 Mar 2026

  • CVE-2026-30239
    28İzleyin

    OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets

    YüksekCVSS 7,1İstismar yokEPSS %0

    openproject · openproject11 Mar 2026

  • CVE-2026-40896
    28İzleyin

    OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup

    YüksekCVSS 7,1İstismar yokEPSS %0

    openproject · openproject20 Nis 2026

  • CVE-2026-22604
    27İzleyin

    OpenProject is vulnerable to user enumeration via the change password function

    OrtaCVSS 6,9İstismar yokEPSS %0

    openproject · openproject9 Oca 2026

  • CVE-2026-22603
    27İzleyin

    OpenProject has no protection against brute-force attacks in the Change Password function

    OrtaCVSS 6,9İstismar yokEPSS %0

    openproject · openproject9 Oca 2026

  • CVE-2021-32763
    26İzleyin

    Regular Expression Denial of Service in OpenProject forum messages

    OrtaCVSS 6,5İstismar yokEPSS %1

    openproject · openproject20 Tem 2021

  • CVE-2023-31140
    26İzleyin

    OpenProject user sessions not terminated after activation of 2FA

    OrtaCVSS 6,5İstismar yokEPSS %1

    openproject · openproject8 May 2023

  • CVE-2026-30235
    26İzleyin

    Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering

    OrtaCVSS 6,5İstismar yokEPSS %1

    openproject · openproject11 Mar 2026

  • CVE-2026-30234
    26İzleyin

    OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)

    OrtaCVSS 6,5İstismar yokEPSS %0

    openproject · openproject11 Mar 2026

  • CVE-2026-23646
    26İzleyin

    OpenProject users can delete other user's session, causing them to be logged out

    OrtaCVSS 6,5İstismar yokEPSS %0

    openproject · openproject19 Oca 2026

  • CVE-2026-24777
    26İzleyin

    OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts

    OrtaCVSS 6,7İstismar yokEPSS %0

    openproject · openproject9 Şub 2026

  • CVE-2019-17092
    24İzleyin

    An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web scri

    OrtaCVSS 6,1İstismar yokEPSS %2

    openproject · openproject9 Eki 2019

  • CVE-2024-41801
    24İzleyin

    OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration

    OrtaCVSS 6,1İstismar yokEPSS %0

    openproject · openproject25 Tem 2024