目標達成 すべての支援者に感謝 — 100%達成しました!

目標: 1000 CNY · 調達済み: 1336 CNY

100%

makeplane 厂商漏洞列表 / CVE 中文分析 16

makeplane 厂商相关 16 条 CVE 漏洞,含 AI 中文分析、POC、CVSS 评分与受影响产品。

该厂商专注于提供开源的数据库管理工具,帮助用户高效管理 PostgreSQL 数据库。历史上常见漏洞类型包括远程代码执行、跨站脚本请求伪造和权限绕过问题。截至最新统计,该项目已记录 14 条 CVE 漏洞,主要集中在身份验证和输入验证环节。安全社区建议用户及时更新版本并实施严格的访问控制措施,以防范潜在攻击风险。

16 件の結果 / 16フィルターをクリア
上位製品 makeplane: plane
CVE IDタイトルCVSS深刻度公開日
CVE-2026-46558 Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces — planeCWE-639 8.3 High2026-06-10
CVE-2026-40102 Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics — planeCWE-943 6.5 Medium2026-05-20
CVE-2026-39843 Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching — planeCWE-918 7.7 High2026-04-09
CVE-2026-27949 Plane Exposes User Email (PII and part of credential) in GET Parameter — planeCWE-200 2.0 Low2026-04-07
CVE-2026-39374 Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint — planeCWE-639 6.5 Medium2026-04-07
CVE-2026-30242 Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer — planeCWE-918 8.5 High2026-03-06
CVE-2026-30244 Plane: Unauthenticated Workspace Member Information Disclosure — planeCWE-284 7.5 High2026-03-06
CVE-2026-27706 Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature — planeCWE-918 7.7 High2026-02-25
CVE-2026-27705 Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch — planeCWE-639 6.5AIMediumAI2026-02-25
CVE-2025-69284 In plane.io, a Guest User to a Workspace can still be able to see list of members — planeCWE-284 4.3 Medium2026-01-02
CVE-2025-62716 Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter — planeCWE-79 8.1 High2025-10-24
CVE-2025-55203 Plane Stored XSS in Add Work Item Functionality — planeCWE-79 5.4 Medium2025-08-15
CVE-2025-48070 Plane has insecure permissions in UserSerializer — planeCWE-276 3.5 Low2025-05-21
CVE-2025-21616 Plane has a Cross-site scripting (XSS) via SVG image upload — planeCWE-79 5.4 Medium2025-01-06
CVE-2024-47830 Plane allows server side request forgery via /_next/image endpoint — planeCWE-918 9.3 Critical2024-10-11
CVE-2024-31461 Plane Server-Side Request Forgery (SSRF) Vulnerability — planeCWE-918 9.1 Critical2024-04-10

本页汇总了 makeplane 厂商截至目前公开的全部 16 条 CVE 漏洞。每条漏洞均包含 CVSS 评分、CWE 弱点分类、受影响产品与参考链接,并附带 AI 生成的中文分析以便快速判断风险。