Skip to content
Noroxi

kanboard records

48 published records for vendor kanboard.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
54.2%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 19
  3. 23
  4. 24
  5. 25
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

48 records
  • CVE-2026-21881
    36Monitor

    Kanboard is Vulnerable to Reverse Proxy Authentication Bypass

    CriticalCVSS 9.1No exploitEPSS 0%

    kanboard · kanboardJan 7, 2026

  • CVE-2017-12850
    35Monitor

    An authenticated standard user could reset the password of other users (including the admin) by altering form data.

    HighCVSS 8.8No exploitEPSS 1%

    kanboard · kanboardAug 14, 2017

  • CVE-2017-12851
    35Monitor

    An authenticated standard user could reset the password of the admin by altering form data.

    HighCVSS 8.8No exploitEPSS 1%

    kanboard · kanboardAug 14, 2017

  • CVE-2023-36813
    35Monitor

    Kanboard Authenticated SQL Injections vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    kanboard · kanboardJul 5, 2023

  • CVE-2025-52560
    35Monitor

    Kanboard Password Reset Poisoning via Host Header Injection

    HighCVSS 8.8No exploitEPSS 0%

    kanboard · kanboardJun 23, 2025

  • CVE-2026-25924
    33Monitor

    Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCE

    HighCVSS 8.4Proof of conceptEPSS 0%

    kanboard · kanboardFeb 11, 2026

  • CVE-2026-33058
    33Monitor

    Kanboard has Authenticated SQL Injection in Project Permissions Handler

    HighCVSS 8.4No exploitEPSS 0%

    kanboard · kanboardMar 18, 2026

  • CVE-2026-24885
    32Monitor

    Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment

    HighCVSS 8.0No exploitEPSS 0%

    kanboard · kanboardFeb 10, 2026

  • CVE-2025-55010
    28Monitor

    Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events

    HighCVSS 7.2No exploitEPSS 1%

    kanboard · kanboardAug 12, 2025

  • CVE-2024-51748
    28Monitor

    Remote code execution through language setting in kanboard

    HighCVSS 7.2No exploitEPSS 0%

    kanboard · kanboardNov 11, 2024

  • CVE-2024-51747
    28Monitor

    Arbitrary File Read and Delete in kanboard

    HighCVSS 7.2Proof of conceptEPSS 0%

    kanboard · kanboardNov 11, 2024

  • CVE-2026-29056
    28Monitor

    Kanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become admin

    HighCVSS 7.0No exploitEPSS 0%

    kanboard · kanboardMar 17, 2026

  • CVE-2014-3920
    27Monitor

    Cross-site request forgery (CSRF) vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrat

    MediumCVSS 6.8No exploitEPSS 0%

    kanboard · kanboardJul 3, 2014

  • CVE-2023-33956
    26Monitor

    Parameter based Indirect Object Referencing leading to private file exposure in Kanboard

    MediumCVSS 6.5No exploitEPSS 0%

    kanboard · kanboardJun 5, 2023

  • CVE-2023-33970
    26Monitor

    Missing access control in internal task links feature in Kanboard

    MediumCVSS 6.5No exploitEPSS 0%

    kanboard · kanboardJun 5, 2023

  • CVE-2024-55603
    26Monitor

    Insufficient session invalidation in Kanboard

    MediumCVSS 6.5No exploitEPSS 0%

    kanboard · kanboardDec 18, 2024

  • CVE-2024-36399
    25Monitor

    Kanboard affected by Project Takeover via IDOR in ProjectPermissionController

    MediumCVSS 6.3No exploitEPSS 0%

    kanboard · kanboardJun 6, 2024

  • CVE-2019-7324
    24Monitor

    app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting.

    MediumCVSS 6.1No exploitEPSS 1%

    kanboard · kanboardFeb 4, 2019

  • CVE-2026-21879
    24Monitor

    Kanboard vulnerable to Open Redirect via protocol-relative URLs

    MediumCVSS 6.1No exploitEPSS 0%

    kanboard · kanboardJan 7, 2026

  • CVE-2024-54001
    22Monitor

    Kanboard allows a persistent HTML injection site scripting in settings page date format

    MediumCVSS 5.5No exploitEPSS 0%

    kanboard · kanboardDec 5, 2024

  • CVE-2023-32685
    21Monitor

    Clipboard based cross-site scripting (blocked with default CSP) in Kanboard

    MediumCVSS 5.4No exploitEPSS 0%

    kanboard · kanboardMay 30, 2023

  • CVE-2023-33969
    21Monitor

    Stored Cross site scripting in the Task External Link Functionality in Kanboard

    MediumCVSS 5.4No exploitEPSS 0%

    kanboard · kanboardJun 5, 2023

  • CVE-2026-21880
    21Monitor

    Kanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information Disclosure

    MediumCVSS 5.3No exploitEPSS 0%

    kanboard · kanboardJan 7, 2026

  • CVE-2025-55011
    21Monitor

    Kanboard Path Traversal in File Write via Task File Upload Api

    MediumCVSS 5.3No exploitEPSS 0%

    kanboard · kanboardAug 12, 2025

  • CVE-2023-33968
    21Monitor

    Missing Access Control allows User to move and duplicate tasks in Kanboard

    MediumCVSS 5.4No exploitEPSS 0%

    kanboard · kanboardJun 5, 2023