Project Management
Monthly
Improper authorization in DevaslanPHP project-management (all versions through 2.0.0-beta1) allows any low-privileged authenticated attacker to remotely invoke the KanbanScrumHelper::recordUpdated function in the Ticket Handler component without adequate permission checks, resulting in unauthorized modification of ticket and kanban board records (integrity impact) and limited disruption of availability. The vendor was notified via GitHub issue #141 but had not responded at time of disclosure, meaning no patch is available. No public exploit code has been identified and the CVE does not appear in CISA KEV.
Improper authorization in DevaslanPHP project-management up to 2.0.0-beta1 allows authenticated remote attackers to edit or delete ticket comments they do not own by exploiting missing ownership validation in the Livewire Handler component. The CVSS vector (PR:L, AV:N, AC:L) confirms the attack is network-accessible and requires only a low-privilege account with no user interaction. No vendor patch exists - the maintainer has not responded to the responsible disclosure submitted via GitHub issue - and no public exploit or CISA KEV listing has been identified at time of analysis.
MyT-PM 1.5.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the Charge[group_total] parameter. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper authorization in DevaslanPHP project-management (all versions through 2.0.0-beta1) allows any low-privileged authenticated attacker to remotely invoke the KanbanScrumHelper::recordUpdated function in the Ticket Handler component without adequate permission checks, resulting in unauthorized modification of ticket and kanban board records (integrity impact) and limited disruption of availability. The vendor was notified via GitHub issue #141 but had not responded at time of disclosure, meaning no patch is available. No public exploit code has been identified and the CVE does not appear in CISA KEV.
Improper authorization in DevaslanPHP project-management up to 2.0.0-beta1 allows authenticated remote attackers to edit or delete ticket comments they do not own by exploiting missing ownership validation in the Livewire Handler component. The CVSS vector (PR:L, AV:N, AC:L) confirms the attack is network-accessible and requires only a low-privilege account with no user interaction. No vendor patch exists - the maintainer has not responded to the responsible disclosure submitted via GitHub issue - and no public exploit or CISA KEV listing has been identified at time of analysis.
MyT-PM 1.5.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the Charge[group_total] parameter. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.