Skip to content
Noroxi

openproject records

37 published records for vendor openproject.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
43.2%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 19
  3. 21
  4. 23
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

37 records
  • CVE-2019-11600
    56Plan

    A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands v

    HighCVSS 8.1Proof of conceptEPSS 80%

    openproject · openprojectMay 13, 2019

  • CVE-2026-25763
    37Monitor

    Command Injection on OpenProject repositories leads to Remote Code Execution

    CriticalCVSS 9.4No exploitEPSS 1%

    openproject · openprojectFeb 6, 2026

  • CVE-2026-24685
    37Monitor

    OpenProject has Argument Injection on Repository module that allows Arbitrary File Write

    CriticalCVSS 9.4No exploitEPSS 0%

    openproject · openprojectJan 28, 2026

  • CVE-2026-22600
    36Monitor

    OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder

    CriticalCVSS 9.1No exploitEPSS 0%

    openproject · openprojectJan 9, 2026

  • CVE-2026-24772
    36Monitor

    OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server

    CriticalCVSS 9.0No exploitEPSS 0%

    openproject · openprojectJan 28, 2026

  • CVE-2021-43830
    35Monitor

    SQL injection in OpenProject

    HighCVSS 8.8No exploitEPSS 1%

    openproject · openprojectDec 14, 2021

  • CVE-2026-22601
    34Monitor

    OpenProject is Vulnerable to Code Execution in E-Mail function

    HighCVSS 8.6No exploitEPSS 0%

    openproject · openprojectJan 9, 2026

  • CVE-2017-11667
    32Monitor

    OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitel

    HighCVSS 8.1No exploitEPSS 1%

    openproject · openprojectJul 26, 2017

  • CVE-2026-34717
    32Monitor

    OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string

    HighCVSS 8.1No exploitEPSS 0%

    openproject · openprojectApr 2, 2026

  • CVE-2023-33960
    30Monitor

    OpenProject vulnerable to project identifier information leakage through robots.txt

    HighCVSS 7.5Proof of conceptEPSS 1%

    openproject · openprojectJun 1, 2023

  • CVE-2026-33667
    29Monitor

    OpenProject: 2FA OTP Verification Missing Rate Limiting

    HighCVSS 7.4No exploitEPSS 0%

    openproject · openprojectApr 15, 2026

  • CVE-2026-24775
    29Monitor

    OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension

    HighCVSS 7.3No exploitEPSS 0%

    openproject · openprojectJan 28, 2026

  • CVE-2026-32698
    28Monitor

    OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution

    HighCVSS 7.2No exploitEPSS 0%

    openproject · openprojectMar 18, 2026

  • CVE-2026-30239
    28Monitor

    OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets

    HighCVSS 7.1No exploitEPSS 0%

    openproject · openprojectMar 11, 2026

  • CVE-2026-40896
    28Monitor

    OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup

    HighCVSS 7.1No exploitEPSS 0%

    openproject · openprojectApr 20, 2026

  • CVE-2026-22604
    27Monitor

    OpenProject is vulnerable to user enumeration via the change password function

    MediumCVSS 6.9No exploitEPSS 0%

    openproject · openprojectJan 9, 2026

  • CVE-2026-22603
    27Monitor

    OpenProject has no protection against brute-force attacks in the Change Password function

    MediumCVSS 6.9No exploitEPSS 0%

    openproject · openprojectJan 9, 2026

  • CVE-2021-32763
    26Monitor

    Regular Expression Denial of Service in OpenProject forum messages

    MediumCVSS 6.5No exploitEPSS 1%

    openproject · openprojectJul 20, 2021

  • CVE-2023-31140
    26Monitor

    OpenProject user sessions not terminated after activation of 2FA

    MediumCVSS 6.5No exploitEPSS 1%

    openproject · openprojectMay 8, 2023

  • CVE-2026-30235
    26Monitor

    Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering

    MediumCVSS 6.5No exploitEPSS 1%

    openproject · openprojectMar 11, 2026

  • CVE-2026-30234
    26Monitor

    OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)

    MediumCVSS 6.5No exploitEPSS 0%

    openproject · openprojectMar 11, 2026

  • CVE-2026-23646
    26Monitor

    OpenProject users can delete other user's session, causing them to be logged out

    MediumCVSS 6.5No exploitEPSS 0%

    openproject · openprojectJan 19, 2026

  • CVE-2026-24777
    26Monitor

    OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts

    MediumCVSS 6.7No exploitEPSS 0%

    openproject · openprojectFeb 9, 2026

  • CVE-2019-17092
    24Monitor

    An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web scri

    MediumCVSS 6.1No exploitEPSS 2%

    openproject · openprojectOct 9, 2019

  • CVE-2024-41801
    24Monitor

    OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration

    MediumCVSS 6.1No exploitEPSS 0%

    openproject · openprojectJul 25, 2024