https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-28254.htmlhttps://patchthecve.com/cve/CVE-2025-28254.htmlWed, 17 Jun 2026 09:04:41 +0000MEDIUM 5.4: Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().https://patchthecve.com/cve/CVE-2024-27477.htmlhttps://patchthecve.com/cve/CVE-2024-27477.htmlWed, 17 Jun 2026 07:19:56 +0000MEDIUM 6.1: In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS vulnerability can be exploited to perform Server-Sihttps://patchthecve.com/cve/CVE-2024-27476.htmlhttps://patchthecve.com/cve/CVE-2024-27476.htmlWed, 17 Jun 2026 07:19:56 +0000MEDIUM 4.7: Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket.https://patchthecve.com/cve/CVE-2024-27474.htmlhttps://patchthecve.com/cve/CVE-2024-27474.htmlWed, 17 Jun 2026 07:19:56 +0000HIGH 8.8: Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators.https://patchthecve.com/cve/CVE-2024-27705.htmlhttps://patchthecve.com/cve/CVE-2024-27705.htmlWed, 17 Jun 2026 07:20:10 +0000HIGH 7.6: Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files/browse endpoint.https://patchthecve.com/cve/CVE-2024-27703.htmlhttps://patchthecve.com/cve/CVE-2024-27703.htmlWed, 17 Jun 2026 07:20:10 +0000MEDIUM 5.4: Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter.