CVE-2023-32685

Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEditable` element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document on a vulnerable Kanboard instance can trick the victim into pasting malicious screenshot data and achieve cross-site scripting if CSP is improperly configured. This issue has been patched in version 1.2.29.

• CWE-79
• CWE-79

• https://github.com/kanboard/kanboard/commit/26b6eebb78d4306e48b836a58f7c386251aa2bc7Patch
• https://github.com/kanboard/kanboard/commit/c9c187206700030c43493b80fd599b4d096cb713Patch
• https://github.com/kanboard/kanboard/security/advisories/GHSA-hjmw-gm82-r4gvVendor Advisory
• https://github.com/kanboard/kanboard/commit/26b6eebb78d4306e48b836a58f7c386251aa2bc7Patch
• https://github.com/kanboard/kanboard/commit/c9c187206700030c43493b80fd599b4d096cb713Patch
• https://github.com/kanboard/kanboard/security/advisories/GHSA-hjmw-gm82-r4gvVendor Advisory

Published

May 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3268An out of bounds (OOB) memory access flaw was found in the L…7.1
• CVE-2023-32680Metabase is an open source business analytics engine. To edi…9.6
• CVE-2023-32681Requests is a HTTP library. Since Requests 2.3.0, Requests h…6.1
• CVE-2023-32682Synapse is a Matrix protocol homeserver written in Python wi…5.4
• CVE-2023-32683Synapse is a Matrix protocol homeserver written in Python wi…5.4
• CVE-2023-32684Lima launches Linux virtual machines, typically on macOS, fo…2.5
• CVE-2023-32686Kiwi TCMS is an open source test management system for both …5.4
• CVE-2023-32687tgstation-server is a toolset to manage production BYOND ser…6.5
• CVE-2023-32688parse-server-push-adapter is the official Push Notification …7.5
• CVE-2023-32689Parse Server is an open source backend that can be deployed …6.5
• CVE-2023-3269A vulnerability exists in the memory management subsystem of…7.8
• CVE-2023-32690libspdm is a sample implementation that follows the DMTF SPD…7.5