{
  "cveId": "CVE-2023-32685",
  "url": "https://patchblox.com/security/cve/CVE-2023-32685",
  "summary": "CVE-2023-32685 is fixed in kanboard on 1 platform by DEBIAN-CVE-2023-32685 (version 1.2.26\u002Bds-3), released May 30, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "kanboard: Kanboard is project management software that focuses on the Kanban methodology",
  "description": "Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the \u0060contentEditable\u0060 element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document on a vulnerable Kanboard instance can trick the victim into pasting malicious screenshot data and achieve cross-site scripting if CSP is improperly configured. This issue has been patched in version 1.2.29.",
  "published": "2023-05-30T05:15:11Z",
  "severity": "medium",
  "cvss": 5.4,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
  "epss": 0.00513,
  "epssPercentile": 0.44004,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "kanboard",
      "release": "Debian 14",
      "fixedVersion": "1.2.26\u002Bds-3",
      "fix": "DEBIAN-CVE-2023-32685",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-32685",
      "released": "2023-05-30T05:15:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}