CVE-2026-10285

MediumCVSS 5.4/10Last modified Jul 22, 2026

Description

A vulnerability has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this issue is the function KanbanScrumHelper::recordUpdated of the file app/Helpers/KanbanScrumHelper.php of the component Ticket Handler. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-266CWE-285

Affected software

No affected versions have been published.

Timeline

Published
Jun 1, 2026
Last modified
Jul 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1028508.8Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.CVE-2026-1028516.1Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.CVE-2026-1028558.8Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.CVE-2026-1028568.8Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.CVE-2026-1028578.8Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.CVE-2026-1028588.8Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.CVE-2026-1028594.6Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attCVE-2026-102866.3A vulnerability was found in CodeAstro Payroll System 1.0. This affects an unknown part of the file /home_employee.php. The manipulation of CVE-2026-1028608.8Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-1028618.8Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-1028628.8Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-1028638.8Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges
CVE-2026-10285: Medium severity, CVSS 5.4 | Vulnix