Log in Start free

Vulnerability · Published May 12, 2025 · Assigned by GitHub_M

CVE-2025-46825Kanboard has stored Cross-site Scripting vulnerability in project name

Low 1.3

In plain English

A low-severity cross-site scripting in kanboard from kanboard. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)1.3Low
Exploit odds (30 days)0.4%top 69.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting (XSS) Vulnerability in the `name` parameter of the `http://localhost/?controller=ProjectCreationController&action=create` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. Note that the default content security policy (CSP) blocks the JavaScript attack, though it can be exploited if an instance is badly configured and the software is vulnerable to CSS injection because of the unsafe-inline on the default CSP. Version 1.2.45 contains a fix for the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14kanboard1.2.47+ds-1DEBIAN-CVE-2025-46825

Affected products (as reported)

VendorProductVersions
kanboard kanboard >= 1.2.26, < 1.2.45

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P

References