CVE-2025-65781High· 8.2▾ TwilightAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any n…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty bearer token, enabling trivial application-layer DoS and latent identity-spoofing.
wekan < 8.16Upgrade past the affected range:
wekan 8.16Connected by shared product, vendor, weakness, or advisory.
CVE-2025-65782Medium· 6.5An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
CVE-2025-65779High· 7.5An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
CVE-2025-65780High· 8.8An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
CVE-2025-65778High· 8.1An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
CVE-2023-49105Critical· 9.8An issue was discovered in ownCloud owncloud/core before 10.13.1
CVE-2019-1946Medium· 6.5A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to bypass authentication and get limited access to the web-based management int…