영향받는 버전 라인
알려진 취약점
| CVE | 제목 | 영향 버전 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|---|
| CVE-2026-85990 | Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods | * | 8.8 | — | 2026-10-14 | |
| CVE-2026-92772 | Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX | < 3.9.6 | 7.1 | — | 2026-09-17 | |
| CVE-2026-54418 | Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypa... | ≤ 3.6.2 | 8.1 | — | 2026-08-05 | |
| CVE-2026-66416 | Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware | ≤ 3.6.2 | 8.6 | — | 2026-07-31 | |
| CVE-2026-66415 | Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import() | ≤ 3.6.2 | 8.4 | — | 2026-07-31 | |
| CVE-2026-66414 | Leantime Open Redirect in Login Controller via redirectUrl Parameter | ≤ 3.6.2 | 5.1 | — | 2026-07-31 | |
| CVE-2026-66412 | Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC | ≤ 3.6.2 | 7.1 | — | 2026-07-27 | |
| CVE-2026-59712 | Leantime - JSON-RPC API Broken Access Control via users.getUser | ≤ 3.4.4 | 8.6 | — | 2026-07-07 | |
| CVE-2026-59713 | Leantime - OIDC Login CSRF via Unconditional State Verification Stub | ≤ 3.4.4 | 8.6 | — | 2026-07-07 | |
| CVE-2025-28254 | Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute a... | * | 5.4 | — | 2025-03-28 | |
| CVE-2024-27476 | Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. | * | 4.7 | — | 2024-04-10 | |
| CVE-2024-27474 | Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors... | * | 8.8 | — | 2024-04-10 | |
| CVE-2024-27477 | In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification fun... | * | 6.1 | — | 2024-04-10 | |
| CVE-2023-45826 | Authenticated SQL Injection in leantime | * | 6.5 | — | 2023-10-20 | |
| CVE-2023-33961 | Leantime Stored Cross-site Scripting Vulnerability | * | 8.9 | — | 2023-05-31 | |
| CVE-2020-5292 | Time-based blind injection in Leantime | * | 8.7 | — | 2020-04-01 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).