UpHeron
All vulnerabilities

Servers and applications

CVE-2019-11600

A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.

Severity
High 8.1
Published
13 May 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.3.2
Exploit chance
80% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
OpenProjectServers and applications · cpe:a:openproject:openproject
  • From 5.0.0 before 8.3.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-11600
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-11600