Kanboard
by Kanboard
Source repositories
CVEs (51)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-51748 | Cri | 0.59 | 9.1 | 0.01 | Nov 11, 2024 | Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code on the server in combination with a file write possibility. The user interface language is determined and loaded by the setting… | ||
| CVE-2024-51747 | Cri | 0.59 | 9.1 | 0.01 | Nov 11, 2024 | Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the server. File attachments, that are viewable or downloadable in Kanboard are resolved through its `path` entry in the… | ||
| CVE-2017-12851 | Hig | 0.57 | 8.8 | 0.01 | Aug 14, 2017 | An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46. | ||
| CVE-2017-12850 | Hig | 0.57 | 8.8 | 0.01 | Aug 14, 2017 | An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46. | ||
| CVE-2026-29056 | Hig | 0.50 | 8.8 | 0.00 | Mar 18, 2026 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint (`UserInviteController::register()`) accepts all POST parameters and passes them to `UserModel::create()` without filtering out the `role` field.… | ||
| CVE-2026-57862 | Hig | 0.48 | 8.5 | 0.00 | Jul 30, 2026 | Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through… | ||
| CVE-2026-58660 | Hig | 0.46 | 8.1 | 0.00 | Jul 15, 2026 | Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but never verifies that the supplied task_id actually belongs to that project.… | ||
| CVE-2024-54001 | Med | 0.36 | 5.5 | 0.00 | Dec 5, 2024 | Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user… | ||
| CVE-2026-33058 | Med | 0.35 | 6.5 | 0.00 | Mar 18, 2026 | Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers with the permission to add users to a project can leverage this vulnerability to dump the entirety of the kanboard… | ||
| CVE-2019-7324 | Med | 0.33 | 6.1 | 0.01 | Feb 4, 2019 | app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting. | ||
| CVE-2024-22720 | Med | 0.31 | 4.8 | 0.00 | Jan 24, 2024 | Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature. | ||
| CVE-2026-56774 | Med | 0.28 | 5.4 | 0.00 | Jun 25, 2026 | Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users' Remember Me sessions. Attackers can enumerate… | ||
| CVE-2017-15212 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another user. | ||
| CVE-2017-15211 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user. | ||
| CVE-2017-15210 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another user. | ||
| CVE-2017-15209 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user. | ||
| CVE-2017-15208 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user. | ||
| CVE-2017-15207 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user. | ||
| CVE-2017-15206 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user. | ||
| CVE-2017-15205 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user. |
- risk 0.59cvss 9.1epss 0.01
Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code on the server in combination with a file write possibility. The user interface language is determined and loaded by the setting…
- risk 0.59cvss 9.1epss 0.01
Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the server. File attachments, that are viewable or downloadable in Kanboard are resolved through its `path` entry in the…
- risk 0.57cvss 8.8epss 0.01
An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46.
- risk 0.57cvss 8.8epss 0.01
An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46.
- risk 0.50cvss 8.8epss 0.00
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint (`UserInviteController::register()`) accepts all POST parameters and passes them to `UserModel::create()` without filtering out the `role` field.…
- risk 0.48cvss 8.5epss 0.00
Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through…
- risk 0.46cvss 8.1epss 0.00
Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but never verifies that the supplied task_id actually belongs to that project.…
- risk 0.36cvss 5.5epss 0.00
Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user…
- risk 0.35cvss 6.5epss 0.00
Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers with the permission to add users to a project can leverage this vulnerability to dump the entirety of the kanboard…
- risk 0.33cvss 6.1epss 0.01
app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting.
- risk 0.31cvss 4.8epss 0.00
Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature.
- risk 0.28cvss 5.4epss 0.00
Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users' Remember Me sessions. Attackers can enumerate…
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user.
Page 1 of 3