| Package | Affected versions | Patched versions |
|---|---|---|
| leantime/leantime | < 3.3 | 3.3 |
| leantime | < 3.3.0 | 3.3.0 |
HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free