Executive brief
Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)
Affected products
- Packagist leantime/leantime
Junglewise Threat Intelligence
Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)
Severity: medium · CVSS 4 · Published 2025-02-21
Technologies: leantime/leantime (Packagist). Vendors: Packagist.
Related threats
- Leantime has HTML injection through firstname and lastname fields
- Duplicate Advisory: Leantime affected by Improper Neutralization of HTML Tags
- Leantime allows Cross-Site Scripting (XSS)
- Leantime affected by Improper Neutralization of HTML Tags
- Leantime has Missing Authorization Check for Host Parameter