Tuleap

CVE-2017-7411 Oct 30, 14:29 HIGH POC THREAT Act Now

An issue was discovered in Enalean Tuleap 9.6 and prior versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 73.9%.

CVE-2014-8791 Dec 02, 01:59 MEDIUM POC THREAT This Month

project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 52.4%.

CVE-2026-24007 Feb 02, 23:16 MEDIUM PATCH This Month

Missing CSRF protection in Tuleap's Overview inconsistent items feature allows authenticated attackers to trick users into performing unwanted actions via crafted requests, potentially leading to unauthorized artifact link creation and data manipulation. The vulnerability affects multiple Tuleap versions and has been patched in Community Edition 17.0.99.1768924735 and Enterprise Edition 17.2-5, 17.1-6, and 17.0-9. This requires user interaction and valid credentials but poses a moderate risk to Tuleap deployments.

CVE-2025-65962 Dec 09, 00:15 MEDIUM PATCH This Month

Missing anti-CSRF protections in Tuleap's tracker field-dependencies feature allow an unauthenticated, network-positioned attacker to modify tracker field configuration by luring an already-authenticated, sufficiently-privileged user into visiting a malicious page while their session is active. Only Tuleap Community Edition before 17.0.99.1763803709 and Enterprise Edition before 17.0-4 and 16.13-9 are affected, and the impact is limited to integrity of tracker fields with no confidentiality or availability loss. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis; EPSS is 0.16% (5th percentile), consistent with a genuinely low-priority issue.

CVE-2025-64760 Dec 08, 23:15 MEDIUM PATCH This Month

Cross-site request forgery in Tuleap Community Edition and Enterprise Edition allows a remote attacker to create or remove tracker triggers when a user with tracker-administration privileges is tricked into loading attacker-controlled content while authenticated. Affected versions are Community Edition before 17.0.99.1763126988 and Enterprise Edition before 17.0-3 and 16.13-8; the flaw is fixed in those releases. EPSS is very low (0.02%, 5th percentile), no public exploit code or CISA KEV entry is identified, and the independent assessment treats this as a genuine but low-priority integrity-only issue.

CVE-2025-64499 Dec 08, 23:15 MEDIUM PATCH This Month

Cross-site request forgery (CSRF) in Tuleap's planning management API enables remote, unauthenticated attackers to create, edit, or remove planning entries by tricking an authenticated user into visiting attacker-controlled content. Affected are Tuleap Community Edition before 17.0.99.1762456922 and Tuleap Enterprise Edition before 17.0-2, 16.13-7, and 16.12-10; vendor patches are available. The CVSS 3.1 score is 5.4 (medium), EPSS is 0.02% (5th percentile), and no public exploit or CISA KEV listing was identified at time of analysis.

CVE-2025-64498 Dec 08, 23:15 MEDIUM PATCH This Month

Cross-site request forgery in Tuleap's tracker general-settings endpoint allows a remote attacker with no account of their own to trick a logged-in user who has tracker-administration rights into silently changing a tracker's general configuration options. The flaw affects Tuleap Community Edition below 17.0.99.1762444754 and Tuleap Enterprise Edition prior to 17.0-2, 16.13-7, and 16.12-10, and is scored CVSS 4.3 with integrity-only impact (no confidentiality or availability loss). Exploitation requires an authenticated, sufficiently privileged victim to interact with attacker-controlled content, and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.02% (5th percentile), indicating a low likelihood of near-term exploitation.

CVE-2025-64497 Dec 08, 23:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99.1762431347 of the Tuleap Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition.

CVE-2025-54877 Aug 29, 16:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.

CVE-2025-50179 Jun 25, 16:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request forgery vulnerability in Tuleap Community Edition prior to version 16.8.99.1749830289 and Tuleap Enterprise Edition prior to version 16.9-1 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1749830289 and Tuleap Enterprise Edition 16.9-1 contain a patch for the issue.

CVE-2025-48991 Jun 25, 14:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Community Edition prior to version 16.8.99.1748845907 and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1748845907, Tuleap Enterprise Edition 16.8-3, and Tuleap Enterprise Edition 16.7-5 contain a fix for the vulnerability.

CVE-2025-30209 Mar 31, 16:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.

CVE-2025-30203 Mar 31, 16:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2025-30155 Mar 31, 16:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.

CVE-2025-29929 Mar 31, 16:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.

CVE-2025-29766 Mar 31, 16:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.

CVE-2025-27402 Mar 04, 17:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.

CVE-2025-27401 Mar 04, 17:15 MEDIUM POC PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2025-27156 Mar 04, 17:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2025-27150 Mar 04, 17:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required.

CVE-2025-27099 Mar 03, 16:15 MEDIUM POC PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2025-27094 Mar 03, 16:15 MEDIUM PATCH This Month

Tuleap is an open-source suite designed to improve software development management and collaboration. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2025-24029 Feb 03, 22:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2025-22129 Feb 03, 22:15 MEDIUM POC PATCH Monitor

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2024-52599 Dec 09, 19:15 MEDIUM POC PATCH This Month

Tuleap is an open source suite to improve management of software developments and collaboration. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2024-47767 Oct 14, 18:15 MEDIUM POC PATCH This Month

Tuleap is a tool for end to end traceability of application and system developments. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2024-47766 Oct 14, 18:15 MEDIUM POC PATCH This Month

Tuleap is a tool for end to end traceability of application and system developments. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2024-46988 Oct 14, 18:15 MEDIUM POC This Month

Tuleap is a tool for end to end traceability of application and system developments. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-46980 Oct 14, 18:15 MEDIUM POC PATCH This Month

Tuleap is a tool for end to end traceability of application and system developments. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2024-39902 Jul 22, 14:15 MEDIUM PATCH This Month

Tuleap is an open source suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2024-37167 Jun 25, 20:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2024-30246 Mar 29, 16:15 HIGH PATCH This Week

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.

CVE-2024-25130 Feb 22, 19:15 MEDIUM PATCH This Month

Tuleap is an open source suite to improve management of software developments and collaboration. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2024-23344 Feb 06, 16:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2023-48715 Dec 11, 19:15 MEDIUM PATCH This Month

Tuleap is an open source suite to improve management of software developments and collaboration. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2023-39521 Aug 24, 23:15 MEDIUM POC PATCH This Month

Tuleap is an open source suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2023-38508 Aug 24, 23:15 MEDIUM POC PATCH This Month

Tuleap is an open source suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2023-35929 Jul 25, 18:15 MEDIUM PATCH This Month

Tuleap is a free and open source suite to improve management of software development and collaboration. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2023-35938 Jun 29, 20:15 HIGH PATCH This Week

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-32072 May 29, 21:15 MEDIUM PATCH This Month

Tuleap is an open source tool for end to end traceability of application and system developments. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2023-30619 May 04, 14:15 MEDIUM PATCH This Month

Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2023-23938 Apr 20, 17:15 MEDIUM PATCH This Month

Tuleap is a Free & Source tool for end to end traceability of application and system developments. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2022-46160 Dec 13, 07:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.

CVE-2022-23473 Dec 13, 07:15 MEDIUM PATCH This Month

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.

CVE-2022-39233 Oct 19, 11:15 MEDIUM POC PATCH This Month

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2022-31128 Aug 01, 17:15 MEDIUM PATCH This Month

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2022-31063 Jun 29, 18:15 MEDIUM PATCH This Month

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2022-31058 Jun 29, 18:15 HIGH PATCH This Week

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.

CVE-2022-31032 Jun 29, 18:15 MEDIUM PATCH This Month

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2022-24896 Jun 09, 06:15 MEDIUM PATCH This Month

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2021-43806 Dec 15, 20:15 HIGH PATCH This Week

Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.

CVE-2021-43782 Dec 15, 20:15 HIGH PATCH This Week

Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

CVE-2021-41276 Dec 15, 20:15 HIGH PATCH This Week

Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

CVE-2021-41155 Oct 18, 22:15 HIGH PATCH This Week

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.

CVE-2021-41154 Oct 18, 22:15 HIGH PATCH This Week

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.

CVE-2021-41148 Oct 15, 14:15 HIGH PATCH This Week

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.

CVE-2021-41147 Oct 15, 14:15 HIGH POC PATCH This Week

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2021-41142 Oct 14, 16:15 MEDIUM PATCH This Month

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2018-17298 Sep 21, 07:29 CRITICAL PATCH Act Now

An issue was discovered in Enalean Tuleap before 10.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2018-7538 Mar 12, 21:29 CRITICAL POC PATCH Act Now

A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to execute arbitrary SQL commands. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2018-7634 Mar 01, 23:29 HIGH POC PATCH This Week

An issue was discovered in Enalean Tuleap 9.17. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2017-7981 Apr 29, 16:59 HIGH POC PATCH THREAT Act Now

Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 12.0%.

CVE-2014-7178 Nov 28, 15:59 CRITICAL POC THREAT Emergency

Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 10.4%.

CVE-2014-7176 Nov 04, 15:55 MEDIUM POC THREAT This Month

SQL injection vulnerability in Enalean Tuleap before 7.5.99.4 allows remote authenticated users to execute arbitrary SQL commands via the lobal_txt parameter to plugins/docman. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 13.8%.

CVE-2014-7177 Oct 31, 14:55 MEDIUM POC THREAT This Month

XML External Entity vulnerability in Enalean Tuleap 7.2 and earlier allows remote authenticated users to read arbitrary files via a crafted xml document in a create action to plugins/tracker/. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 12.3%.