CVE-2023-33961

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Javascript into a comment. Once the malicious comment is loaded in the browser by a user, the malicious Javascript code executes. As of time of publication, a patch does not exist.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-339626.1JStachio is a type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowi CVE-2023-339639.8DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the Data CVE-2023-339647.5mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard mi CVE-2023-339658.8Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection. An attacker may fool CVE-2023-339669.8Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `no CVE-2023-339679.8EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/Pos CVE-2023-339685.4Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missin CVE-2023-339695.4Kanboard is open source project management software that focuses on the Kanban methodology. A stored Cross site scripting (XSS) allows an at CVE-2023-33976.3A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw a CVE-2023-339706.5Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access con CVE-2023-339715.4Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled. A probabl CVE-2023-339728.8Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to crea