CVE-2026-25764

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time tracking function of OpenProject. The application does not escape HTML tags, an attacker with administrator privileges can create a work package with the name containing the HTML tags and add it to the Work package section when creating time tracking. This issue has been patched in versions 16.6.7 and 17.0.3.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published: Feb 6, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-257655.8Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's build_ex CVE-2026-257665.3Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path CVE-2026-257678.1LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could creat CVE-2026-257686.5LavinMQ is a high-performance message queue & streaming server. Before 2.6.6, an authenticated user could access metadata in the broker they CVE-2026-257699.1Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Co CVE-2026-257710.0The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not CVE-2026-257707.2Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version CVE-2026-257717.5Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.3.0 and prior to version CVE-2026-257727.2Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version CVE-2026-257736.5** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements CVE-2026-257745.3Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-257759.8A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be performed without authe