OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"

OpenProject has Argument Injection on Repository module that allows Arbitrary File Write

OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposure

OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string

OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"

OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks

OpenProject: 2FA OTP Verification Missing Rate Limiting

OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension

OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution

OpenProject is Vulnerable to Code Execution in E-Mail function

OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup

OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets