Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

Leantime XSS in To-Do Title Field

published 1 year ago
Summary

Leantime has a security issue affecting the title field of its To-Do feature. If not fixed, an attacker could inject malicious code into the title field, potentially taking control of user sessions and sensitive data. Update Leantime to the latest version to resolve this issue.

What to do
  • Update leantime leantime to version 3.3.
Affected software
Ecosystem VendorProductAffected versions
composer leantime leantime < 3.3
Fix: upgrade to 3.3
Original advisory text
Leantime allows Cross-Site Scripting (XSS)
### Summary
There is a cross-site scripting vulnerability on To-Do that affects a title field of a To-Do.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.1 Low
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published21 Feb 2025
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-f679-254h-qhvj · GHSA
Track software like this
Free during beta