CVE-2026-94211

LOW 2.4

Hyve5 Leantime Project Dashboard show.blade.php cross site scripting

CVSS Score

2.4

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. "EDIT perm" needed to plant; fires cross-user for anyone viewing the project dashboard since the poisoned label name is echoed raw. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-79 CWE-94
Vendor	hyve5
Product	leantime
Published	Sep 21, 2026

Stay Ahead of the Next One

Get instant alerts for hyve5 leantime

Be the first to know when new low vulnerabilities affecting hyve5 leantime are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Hyve5 / Leantime

3.9.0 3.9.1 3.9.2 3.9.3 3.9.4 3.9.5 3.9.6 3.9.7 3.9.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/408069 vuldb.com: https://vuldb.com/vuln/408069/cti vuldb.com: https://vuldb.com/cve/CVE-2026-94211 vuldb.com: https://vuldb.com/submit/894647 github.com: https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Stored%20XSS%20in%20Leantime%20Status%20Labels%20Enables%20Privilege%20Escalation%20to%20Owner

Credits

🔍 alvinovando-thoropass (VulDB User) VulDB CNA Team