CVE-2026-10285: medium-severity vulnerability in DevaslanPHP project-management
DevaslanPHP project-management Ticket KanbanScrumHelper.php recordUpdated improper authorization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
A vulnerability has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this issue is the function KanbanScrumHelper::recordUpdated of the file app/Helpers/KanbanScrumHelper.php of the component Ticket Handler. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Affected products
DevaslanPHP · project-managementRelated CVEs — DevaslanPHP project-management
In the same product, most dangerous first.
CVE-2026-10284MEDIUMDevaslanPHP project-management Livewire ViewTicket.php doDeleteComment improper authorizationEPSS 0.2%CVE-2026-100899MEDIUMDevaslanPHP project-management Timesheet Dashboard MonthlyReport.php whereRaw sql injectionEPSS 0.2%CVE-2026-100898MEDIUMDevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injectionEPSS 0.2%CVE-2026-100900MEDIUMDevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgeryEPSS 0.2%