{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-11T15:56:45.364","vulnerabilities":[{"cve":{"id":"CVE-2025-46825","sourceIdentifier":"security-advisories@github.com","published":"2025-05-12T23:15:25.350","lastModified":"2025-07-11T14:41:27.417","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting (XSS) Vulnerability in the `name` parameter of the `http://localhost/?controller=ProjectCreationController&action=create` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. Note that the default content security policy (CSP) blocks the JavaScript attack, though it can be exploited if an instance is badly configured and the software is vulnerable to CSS injection because of the unsafe-inline on the default CSP. Version 1.2.45 contains a fix for the issue."},{"lang":"es","value":"Kanboard es un software de gestión de proyectos basado en la metodología Kanban. Las versiones 1.2.26 a 1.2.44 presentan una vulnerabilidad de Cross Site Scripting (XSS) almacenado en el parámetro `name` del formulario `http://localhost/?controller=ProjectCreationController&action=create`. Esta vulnerabilidad permite a los atacantes inyectar scripts maliciosos en páginas web visitadas por otros usuarios. Tenga en cuenta que la política de seguridad de contenido (CSP) predeterminada bloquea el ataque de JavaScript, aunque puede explotarse si una instancia está mal configurada y el software es vulnerable a la inyección de CSS debido a la función unsafe-inline de la CSP predeterminada. La versión 1.2.45 contiene una solución para este problema."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*","versionStartIncluding":"1.2.26","versionEndExcluding":"1.2.45","matchCriteriaId":"9FD04A5B-FCB2-4AF3-B5D8-56ACC4EC796D"}]}]}],"references":[{"url":"https://github.com/kanboard/kanboard/blame/v1.2.44/app/Template/project_view/importTasks.php#L11","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://github.com/kanboard/kanboard/commit/6ebf22eeaae9f8b4abab72e3c18e45a2c4a2a808","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/kanboard/kanboard/commit/ac94004ea9fc455dcc5edc8a242d67d1ccd85564","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/kanboard/kanboard/security/advisories/GHSA-5wj3-c9v4-pj9v","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/kanboard/kanboard/security/advisories/GHSA-5wj3-c9v4-pj9v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}}]}