CVE-2024-27476

Published: Apr 10, 2024Modified: Jun 17, 2026

4.7

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket.

Affected (1)

Products: Leantime: Leantime

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Leantime Leantime	Version 3.0.6

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (6)

https://drive.proton.me/urls/X9G9MY1FAW#NLS8RkHUihLY

Source: cve@mitre.org

Broken Link

https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20

Source: cve@mitre.org

Product

https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md

Source: cve@mitre.org

ExploitThird Party Advisory

https://drive.proton.me/urls/X9G9MY1FAW#NLS8RkHUihLY

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.