https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-23T09:06:33.034812+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-57768 CVE-2025-57768 — Stored XSS in “hours” fields when creating or editing an issue, using SQLite database 2026-10-23T09:06:33.050767+00:00

Affected: Alanaktion phproject

Phproject is a high performance full-featured project management system. From 1.8.0 to before 1.8.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Planned Hours field when creating a new project. When sending a POST request to /issues/new/, the value provided in the Planned Hours field is included in the server response without any HTML encoding or sanitization. Because of this, an attacker can craft a malicious payload such as <script>alert(1)</script> and include it in the planned_hours parameter. The server reflects the input directly in the HTML of the project creation page, causing the browser to interpret and execute it. This vulnerability is fixed in 1.8.3.