Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by Hyve5
CVE-2026-94211 (GCVE-0-2026-94211)
Vulnerability from nvd – Published: 2026-09-21 12:00 – Updated: 2026-09-21 14:14
VLAI
EPSS
VEX
Title
Hyve5 Leantime Project Dashboard show.blade.php cross site scripting
Summary
A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. "EDIT perm" needed to plant; fires cross-user for anyone viewing the project dashboard since the poisoned label name is echoed raw. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 14:14 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/408069 | vdb-entry |
| https://vuldb.com/vuln/408069/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-94211 | third-party-advisory |
| https://vuldb.com/submit/894647 | third-party-advisory |
| https://github.com/natanmorette-thoropass/thoropa… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94211",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T14:14:32.453826Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T14:14:43.402Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*"
],
"modules": [
"Project Dashboard"
],
"product": "Leantime",
"vendor": "Hyve5",
"versions": [
{
"status": "affected",
"version": "3.9.0"
},
{
"status": "affected",
"version": "3.9.1"
},
{
"status": "affected",
"version": "3.9.2"
},
{
"status": "affected",
"version": "3.9.3"
},
{
"status": "affected",
"version": "3.9.4"
},
{
"status": "affected",
"version": "3.9.5"
},
{
"status": "affected",
"version": "3.9.6"
},
{
"status": "affected",
"version": "3.9.7"
},
{
"status": "affected",
"version": "3.9.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "alvinovando-thoropass (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. \"EDIT perm\" needed to plant; fires cross-user for anyone viewing the project dashboard since the poisoned label name is echoed raw. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T12:00:10.792Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-408069 | Hyve5 Leantime Project Dashboard show.blade.php cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/408069"
},
{
"name": "VDB-408069 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/408069/cti"
},
{
"name": "CVE-2026-94211 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-94211"
},
{
"name": "Submit #894647 | Hyve5 Inc DBA Leantime Leantime 3.9.8 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/894647"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Stored%20XSS%20in%20Leantime%20Status%20Labels%20Enables%20Privilege%20Escalation%20to%20Owner"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-21T07:40:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "Hyve5 Leantime Project Dashboard show.blade.php cross site scripting",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-94211",
"datePublished": "2026-09-21T12:00:10.792Z",
"dateReserved": "2026-09-21T05:35:34.423Z",
"dateUpdated": "2026-09-21T14:14:43.402Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94210 (GCVE-0-2026-94210)
Vulnerability from nvd – Published: 2026-09-21 11:30 – Updated: 2026-09-21 19:41 X_Open Source
VLAI
EPSS
VEX
Title
Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting
Summary
A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:41 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/408068 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/408068/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-94210 | third-party-advisory |
| https://vuldb.com/submit/894646 | third-party-advisory |
| https://github.com/natanmorette-thoropass/thoropa… | exploit |
| https://github.com/Leantime/leantime/pull/3767 | issue-trackingpatch |
| https://github.com/Leantime/leantime/commit/a30a6… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94210",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:41:05.304347Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:41:11.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*"
],
"modules": [
"Kanban Board"
],
"product": "Leantime",
"vendor": "Hyve5",
"versions": [
{
"status": "affected",
"version": "3.9.0"
},
{
"status": "affected",
"version": "3.9.1"
},
{
"status": "affected",
"version": "3.9.2"
},
{
"status": "affected",
"version": "3.9.3"
},
{
"status": "affected",
"version": "3.9.4"
},
{
"status": "affected",
"version": "3.9.5"
},
{
"status": "affected",
"version": "3.9.6"
},
{
"status": "affected",
"version": "3.9.7"
},
{
"status": "affected",
"version": "3.9.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "alvinovando-thoropass (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T11:30:13.129Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-408068 | Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/408068"
},
{
"name": "VDB-408068 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/408068/cti"
},
{
"name": "CVE-2026-94210 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-94210"
},
{
"name": "Submit #894646 | Hyve5 Inc DBA Leantime Leantime 3.9.8 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/894646"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Stored%20XSS%20in%20Leantime%20Kanban%20Swimlane%20Headers%20Enables%20Privilege%20Escalation%20to%20Owner"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Leantime/leantime/pull/3767"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Leantime/leantime/commit/a30a6837b4071ac05a4f58d0e1baa2c62aa8695e"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-21T07:40:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-94210",
"datePublished": "2026-09-21T11:30:13.129Z",
"dateReserved": "2026-09-21T05:35:30.232Z",
"dateUpdated": "2026-09-21T19:41:11.894Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94211 (GCVE-0-2026-94211)
Vulnerability from cvelistv5 – Published: 2026-09-21 12:00 – Updated: 2026-09-21 14:14
VLAI
EPSS
VEX
Title
Hyve5 Leantime Project Dashboard show.blade.php cross site scripting
Summary
A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. "EDIT perm" needed to plant; fires cross-user for anyone viewing the project dashboard since the poisoned label name is echoed raw. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 14:14 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/408069 | vdb-entry |
| https://vuldb.com/vuln/408069/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-94211 | third-party-advisory |
| https://vuldb.com/submit/894647 | third-party-advisory |
| https://github.com/natanmorette-thoropass/thoropa… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94211",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T14:14:32.453826Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T14:14:43.402Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*"
],
"modules": [
"Project Dashboard"
],
"product": "Leantime",
"vendor": "Hyve5",
"versions": [
{
"status": "affected",
"version": "3.9.0"
},
{
"status": "affected",
"version": "3.9.1"
},
{
"status": "affected",
"version": "3.9.2"
},
{
"status": "affected",
"version": "3.9.3"
},
{
"status": "affected",
"version": "3.9.4"
},
{
"status": "affected",
"version": "3.9.5"
},
{
"status": "affected",
"version": "3.9.6"
},
{
"status": "affected",
"version": "3.9.7"
},
{
"status": "affected",
"version": "3.9.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "alvinovando-thoropass (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. \"EDIT perm\" needed to plant; fires cross-user for anyone viewing the project dashboard since the poisoned label name is echoed raw. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T12:00:10.792Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-408069 | Hyve5 Leantime Project Dashboard show.blade.php cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/408069"
},
{
"name": "VDB-408069 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/408069/cti"
},
{
"name": "CVE-2026-94211 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-94211"
},
{
"name": "Submit #894647 | Hyve5 Inc DBA Leantime Leantime 3.9.8 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/894647"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Stored%20XSS%20in%20Leantime%20Status%20Labels%20Enables%20Privilege%20Escalation%20to%20Owner"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-21T07:40:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "Hyve5 Leantime Project Dashboard show.blade.php cross site scripting",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-94211",
"datePublished": "2026-09-21T12:00:10.792Z",
"dateReserved": "2026-09-21T05:35:34.423Z",
"dateUpdated": "2026-09-21T14:14:43.402Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94210 (GCVE-0-2026-94210)
Vulnerability from cvelistv5 – Published: 2026-09-21 11:30 – Updated: 2026-09-21 19:41 X_Open Source
VLAI
EPSS
VEX
Title
Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting
Summary
A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:41 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/408068 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/408068/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-94210 | third-party-advisory |
| https://vuldb.com/submit/894646 | third-party-advisory |
| https://github.com/natanmorette-thoropass/thoropa… | exploit |
| https://github.com/Leantime/leantime/pull/3767 | issue-trackingpatch |
| https://github.com/Leantime/leantime/commit/a30a6… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94210",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:41:05.304347Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:41:11.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*"
],
"modules": [
"Kanban Board"
],
"product": "Leantime",
"vendor": "Hyve5",
"versions": [
{
"status": "affected",
"version": "3.9.0"
},
{
"status": "affected",
"version": "3.9.1"
},
{
"status": "affected",
"version": "3.9.2"
},
{
"status": "affected",
"version": "3.9.3"
},
{
"status": "affected",
"version": "3.9.4"
},
{
"status": "affected",
"version": "3.9.5"
},
{
"status": "affected",
"version": "3.9.6"
},
{
"status": "affected",
"version": "3.9.7"
},
{
"status": "affected",
"version": "3.9.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "alvinovando-thoropass (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T11:30:13.129Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-408068 | Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/408068"
},
{
"name": "VDB-408068 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/408068/cti"
},
{
"name": "CVE-2026-94210 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-94210"
},
{
"name": "Submit #894646 | Hyve5 Inc DBA Leantime Leantime 3.9.8 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/894646"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Stored%20XSS%20in%20Leantime%20Kanban%20Swimlane%20Headers%20Enables%20Privilege%20Escalation%20to%20Owner"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Leantime/leantime/pull/3767"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Leantime/leantime/commit/a30a6837b4071ac05a4f58d0e1baa2c62aa8695e"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-21T07:40:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-94210",
"datePublished": "2026-09-21T11:30:13.129Z",
"dateReserved": "2026-09-21T05:35:30.232Z",
"dateUpdated": "2026-09-21T19:41:11.894Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}