CVE-2023-45826 Scanner
CVE-2023-45826 Scanner - SQL Injection (SQLi) vulnerability in Leantime
Used 2.6k times · 3.4k assets checked · domain, subdomain, ipv4
CVE
CVE-2023-45826
6.5
CVSSmedium
Exploitable remotely over the internet · low-privilege account sufficient.
Description
Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack Vector
Network
Privileges Req.
Low
User Interaction
None
leantime
Updated Sep 28, 2026View on NVD →
S4E scanner
CVE history: leantime
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →