OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts

Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering

OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)

OpenProject users can delete other user's session, causing them to be logged out

OpenProject has no protection against brute-force attacks in the Change Password function

OpenProject is open source project management software

OpenProject is open-source, web-based project management software

OpenProject is open source project management software

An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter…

OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy

OpenProject has stored XSS regression using attachments and script-src self

OpenProject is open-source, web-based project management software

OpenProject is the leading open source project management software

OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects

OpenProject is vulnerable to user enumeration via the change password function

Blind SSRF on OpenProject instance via webhooks

OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate

OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer

OpenProject users with "View Members" permission in any project can view all Group memberships

OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings