CVE-2026-33058

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers with the permission to add users to a project can leverage this vulnerability to dump the entirety of the kanboard database. Version 1.2.51 fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
kanboard	kanboard	< 1.2.51

References

https://github.com/kanboard/kanboard/security/advisories/GHSA-f62r-m4mr-2xhhExploit, Vendor Advisory

Timeline

Published: Mar 18, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-33064.3An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and CVE-2026-330605.7CKAN MCP Server is a tool for querying CKAN open data portals. Versions prior to 0.4.85 provide tools including ckan_package_search and spar CVE-2026-330615.4Jexactyl is a customisable game management panel and billing system. Commits after 025e8dbb0daaa04054276bda814d922cf4af58da and before e28ed CVE-2026-330627.5free5GC is an open source 5G core network. free5GC NRF prior to version 1.4.2 has an Improper Input Validation vulnerability leading to Deni CVE-2026-330637.5free5GC is an open source 5G core network. free5GC AUSF prior to version 1.4.2 has is an Improper Null Check vulnerability leading to Denial CVE-2026-330647.5Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to p CVE-2026-330655.3Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorre CVE-2026-330669.0SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the backend renderREADME function uses lute.New() without cal CVE-2026-330679.0SiYuan is a personal knowledge management system. Versions 3.6.0 and below render package metadata fields (displayName, description) using t CVE-2026-330688.8Claude Code is an agentic coding tool. Versions prior to 2.1.53 resolved the permission mode from settings files, including the repo-control CVE-2026-330697.5PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap r CVE-2026-33072.7An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repositor