{"kind": "product", "path": "vulns/packagist/leantime%2Fleantime", "name": "leantime/leantime", "product": "leantime/leantime", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-85990", "noindex": false, "published": "2026-10-13T16:15:09.529Z", "modified": "2026-10-16T22:08:17.288Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00417, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-85990", "title": "Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods", "description": "Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator a", "references": ["https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp", "https://github.com/Leantime/leantime/pull/3583", "https://github.com/Leantime/leantime/pull/3797"], "fixes": ["3.10.0"], "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}]}, {"id": "GHSA-qrfh-cc86-vc8c", "noindex": false, "published": "2026-03-05T18:05:57Z", "modified": "2026-03-05T18:16:35.270983Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-qrfh-cc86-vc8c", "title": "Leantime has HTML injection through firstname and lastname fields", "description": "### Summary\nLeantime v2.3.27 is vulnerable to Stored HTML Injection. The `firstname` and `lastname` fields in the admin user edit page are rendered without  HTML escaping, allowing an authenticated user to inject arbitrary HTML that executes when the profile is viewed.\n\n### Vulnerable File\n`app/Domain/Users/Templates/editUser.tpl.php`\n\n### Vulnerable Code (Lines ~14-17)\n```php\nvalue=\"<?php echo $values['firstname'] ?>\"\nvalue=\"<?php echo $values['lastname'] ?>\"\n```\nThese fields output raw user input without sanitization.\n\n### Steps to Reproduce\n1. Login as admin > Go to Settings > Users > Edit any user\n2. Enter HTML payload in First Name or La", "references": ["https://github.com/Leantime/leantime/security/advisories/GHSA-qrfh-cc86-vc8c", "https://github.com/Leantime/leantime/commit/3f8b2c6346111694bb18cec558b27c22d3a2b9d1", "https://github.com/Leantime/leantime"], "fixes": ["3.3.0"], "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-28254", "noindex": false, "published": "2025-03-28T00:00:00.000Z", "modified": "2025-04-01T20:08:41.614Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00334, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-28254", "title": "CVE-2025-28254", "description": "Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().", "references": ["https://github.com/Leantime/leantime/blob/0e7ddbbe3d582f657a1dddfef7b3419ae588cbf7/app/Domain/Notifications/Services/Notifications.php#L128", "https://github.com/Leantime/leantime/commit/ce1d2073e4601183e1bdd90f4b433d16aee46a50", "https://github.com/Leantime/leantime/security/advisories/GHSA-95j3-435g-vjcp"], "fixes": ["3.3"], "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}]}, {"id": "GHSA-f679-254h-qhvj", "noindex": false, "published": "2025-02-21T23:54:31Z", "modified": "2025-02-22T00:25:28.870500Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-f679-254h-qhvj", "title": "Leantime allows Cross-Site Scripting (XSS)", "description": "### Summary\nThere is a cross-site scripting vulnerability on To-Do that affects a title field of a To-Do.", "references": ["https://github.com/Leantime/leantime/security/advisories/GHSA-f679-254h-qhvj", "https://github.com/Leantime/leantime", "https://osv.dev/vulnerability/GHSA-f679-254h-qhvj"], "fixes": ["3.3"], "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}]}, {"id": "GHSA-3hfj-qcvj-4hx8", "noindex": false, "published": "2025-02-21T23:53:22Z", "modified": "2025-02-22T00:15:43.483074Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-3hfj-qcvj-4hx8", "title": "Leantime has Missing Authorization Check for Host Parameter", "description": "### Finding Description\nApplication has functionality for a user to view profile information. It does not have an implemented authorization check for \"Host\" parameter which allows a user to view profile information of another user by replacing \"Host\" parameter.\n\n### Impact\nBy exploiting this vulnerability an attacker can able to view profile information (but not anything else or change anything)", "references": ["https://github.com/Leantime/leantime/security/advisories/GHSA-3hfj-qcvj-4hx8", "https://github.com/Leantime/leantime", "https://osv.dev/vulnerability/GHSA-3hfj-qcvj-4hx8"], "fixes": ["3.3"], "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}]}, {"id": "GHSA-c39w-3pjx-qc7m", "noindex": false, "published": "2025-02-21T22:48:46Z", "modified": "2025-02-21T23:12:28.248022Z", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-c39w-3pjx-qc7m", "title": "Leantime allows Stored Cross-Site Scripting (XSS)", "description": "### Description\nLeantime allows stored cross-site scripting (XSS) in the API key name while generating the API key.\n\n### Impact\nAny low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more.", "references": ["https://github.com/Leantime/leantime/security/advisories/GHSA-c39w-3pjx-qc7m", "https://github.com/Leantime/leantime", "https://osv.dev/vulnerability/GHSA-c39w-3pjx-qc7m"], "fixes": ["3.3"], "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}]}, {"id": "GHSA-92xh-6x7v-4rmq", "noindex": false, "published": "2025-02-21T22:48:41Z", "modified": "2025-02-21T23:11:51.954583Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-92xh-6x7v-4rmq", "title": "Leantime allows Cross-Site Request Forgery (CSRF)", "description": "**CSRF**\n### Summary\nA cross-site request forgery vulnerability allows a remote actor to create an account with Owner privileges. By luring an Owner or Administrator into clicking a button on an attacker-controlled website, a request will be issued, generating an account with the attacker's information and role of their choosing. \n\n### Impact\nWhile the likelihood of a successful exploit is low, the impact would be high as the attacker could then gain complete control over the victim's environment.", "references": ["https://github.com/Leantime/leantime/security/advisories/GHSA-92xh-6x7v-4rmq", "https://github.com/Leantime/leantime", "https://osv.dev/vulnerability/GHSA-92xh-6x7v-4rmq"], "fixes": ["3.1.2"], "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}]}, {"id": "GHSA-v4q9-437p-mhpg", "noindex": false, "published": "2025-02-21T22:48:26Z", "modified": "2025-02-21T23:12:10.340478Z", "cvss": 7.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-v4q9-437p-mhpg", "title": "Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)", "description": "### Summary\nA cross-site scripting (XSS) vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user-sensitive information. The code does not include any validation or sanitization of the $_GET[\"id\"] parameter. As a result, it directly incorporates the user-supplied value into the source path without any checks.", "references": ["https://github.com/Leantime/leantime/security/advisories/GHSA-v4q9-437p-mhpg", "https://github.com/Leantime/leantime", "https://osv.dev/vulnerability/GHSA-v4q9-437p-mhpg"], "fixes": ["3.3"], "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}]}, {"id": "GHSA-63cr-xg3f-8jvr", "noindex": false, "published": "2025-02-21T22:15:52Z", "modified": "2025-02-21T22:35:45.762491Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-63cr-xg3f-8jvr", "title": "Leantime allows Stored Cross-Site Scripting (XSS)", "description": "### Summary\nStored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. \n\n### Details\nA Stored Cross-Site Scripting (XSS) vulnerability was found that could potentially compromise user data and pose a significant security risk to the platform.\n\n### PoC\n\n- Create a project\n- Navigate to project\n- Visit to the integration\n- Add malicious payload inside the webhook and save it.\n- Notice the alert dialogue indicating successful execution of the XSS payload.\n```\n'';!--\" onfocus=alert(0) autofocus=\"\"  onload=alert(3);=\"&amp;{(alert(1))}\" |=\"\" mu", "references": ["https://github.com/Leantime/leantime/security/advisories/GHSA-63cr-xg3f-8jvr", "https://github.com/Leantime/leantime", "https://youtu.be/kqKFgsOqstg"], "fixes": [], "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}]}, {"id": "GHSA-52xf-h226-pfgx", "noindex": false, "published": "2025-02-21T22:15:26Z", "modified": "2025-02-21T22:25:43.402371Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-52xf-h226-pfgx", "title": "Leantime allows Refelected Cross-Site Scripting (XSS)", "description": "### Summary\nThe vulnerability in Leantime's \"overdue\" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauthorized actions. Improving input validation and output encoding in the file upload process can prevent this exploit. Accessing and enhancing the relevant source code modules is crucial for addressing this security flaw effectively.\n\n### Impact\nThis XSS vulnerability allows attackers to inject malicious scripts into the Leantime application, compromising user data, session tokens, and poten", "references": ["https://github.com/Leantime/leantime/security/advisories/GHSA-52xf-h226-pfgx", "https://github.com/Leantime/leantime", "https://osv.dev/vulnerability/GHSA-52xf-h226-pfgx"], "fixes": ["3.3"], "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}]}, {"id": "GHSA-h6w8-27ph-c385", "noindex": false, "published": "2025-02-21T22:15:19Z", "modified": "2025-02-21T22:26:17.882589Z", "cvss": 5.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-h6w8-27ph-c385", "title": " Leantime has Insufficiently Protected Credentials", "description": "Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore.\n\nAdditional Information:\n\n    1.The issue was identified during routine security testing.\n    2.This vulnerability poses a significant risk to user privacy and data security.\n    3.Urgent action is recommended to mitigate this vulnerability and protect user data from unauthorized access.", "references": ["https://github.com/Leantime/leantime/security/advisories/GHSA-h6w8-27ph-c385", "https://github.com/Leantime/leantime", "https://osv.dev/vulnerability/GHSA-h6w8-27ph-c385"], "fixes": ["3.3"], "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}]}, {"id": "GHSA-mg4c-884j-pcq9", "noindex": false, "published": "2025-02-21T22:14:58Z", "modified": "2025-02-21T22:26:34.328094Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-mg4c-884j-pcq9", "title": "Leantime allows Stored Cross-Site Scripting (XSS)", "description": "STORED XSS +OPEN REDIRECTION in SVG uploads\nVulnerable url:https://hack.leantime.io/projects/showProject/3", "references": ["https://github.com/Leantime/leantime/security/advisories/GHSA-mg4c-884j-pcq9", "https://github.com/Leantime/leantime/commit/d8b1099b0629da64ad30a1c4daee104fadc6c227", "https://github.com/Leantime/leantime"], "fixes": ["3.3"], "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}]}, {"id": "GHSA-99r5-84gr-59f6", "noindex": false, "published": "2025-02-21T22:14:50Z", "modified": "2025-02-21T22:35:47.200449Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-99r5-84gr-59f6", "title": "Leantime has Host Header Injection Vulnerability ", "description": "### Summary\nA host header injection vulnerability has been identified in the user details viewing functionality of the system. This vulnerability allows an attacker to manipulate the host header in HTTP requests, thereby gaining unauthorized access to view details of other users.", "references": ["https://github.com/Leantime/leantime/security/advisories/GHSA-99r5-84gr-59f6", "https://github.com/Leantime/leantime", "https://osv.dev/vulnerability/GHSA-99r5-84gr-59f6"], "fixes": ["3.1.2"], "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}]}], "total": 13, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "leantime/leantime", "path": "vulns/packagist/leantime%2Fleantime", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-16T22:08:17.288Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}