CVE-2019-11600

PoC ×3—

CVSS 3.0

8.1 high

EPSS

80%p100

Published

May 13, 2019 (May 13, 2019)

Modified

Jun 17, 2026

Description

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.

Vendors: openproject
Products: openproject
Weakness: CWE-89
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (80.0%)

In the news0 stories

No ingested article mentions this CVE yet.