Secure peace of mind with Cyber Legion—Your Trusted Cybersecurity Partner.

Speak With a Security Expert

Elevate your cybersecurity posture with our expert and strategic security solutions

Experience the assurance of CREST Certified Penetration Testing services

CVE-2023-45826

Leantime is an open source project management system. A ‘userId’ variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVSS:6.5) (EPSS:0.05%) (Last Update:2023-10-27 15:27:30)   Latest security vulnerabilities (SQL Injection) (CVSS score >= 4) – Deprecated! See channel description 

​ 

 

More To Explore