Debian Kanboard vulnerabilities

CVE-2023-32685 [MEDIUM] CVE-2023-32685: kanboard - Kanboard is project management software that focuses on the Kanban methodology. ... Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEditable` element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document on a vulnerable Kanboard instance can trick the victim into pasti

CVE-2024-54001 [MEDIUM] CVE-2024-54001: kanboard - Kanboard is project management software that focuses on the Kanban methodology. ... Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user input which is reflected. The vulnerability can become xss if the user input is javascri

CVE-2025-46825 [LOW] CVE-2025-46825: kanboard - Kanboard is project management software that focuses on the Kanban methodology. ... Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting (XSS) Vulnerability in the `name` parameter of the `http://localhost/?controller=ProjectCreationController&action=create` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other

CVE-2026-25531 [MEDIUM] CVE-2026-25531: kanboard - Kanboard is project management software focused on Kanban methodology. Prior to ... Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects, allowing authenticated users to duplicate tasks into projects they cannot access. This vulnerability is fixed in 1.2.50. S

CVE-2026-25530 [MEDIUM] CVE-2026-25530: kanboard - Kanboard is project management software focused on Kanban methodology. Prior to ... Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50. Scope: local forky: resolved (fixed in 1.2.50+ds-1) sid: resolved (fixed in 1.2.50+ds-1)

CVE-2024-22720 [MEDIUM] CVE-2024-22720: kanboard - Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature. Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature. Scope: local forky: resolved (fixed in 1.2.44+ds-1) sid: resolved (fixed in 1.2.44+ds-1)