PT-2026-96088 · Hyve5 · Leantime
CVSS v2.0
3.3
Low
| Vector | AV:N/AC:L/Au:M/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Hyve5 Leantime versions prior to 3.9.9
Description
A remote cross-site scripting issue exists in the Project Dashboard component within the file
/app/Domain/Dashboard/Templates/show.blade.php. An attacker with EDIT permissions can inject a malicious payload into a label name, which is then echoed raw to any user viewing the project dashboard.Recommendations
Update Hyve5 Leantime to version 3.9.9 or later.
Exploit
Fix
XSS
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Leantime