Redmine vulnerabilities
Published CVEs affecting Redmine products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-1836
Medium · 5.3
CWE-257 Jun 12, 2026
Stored credentials in Redmine
The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials.
CVE-2020-37105
High · 7.1
CWE-89 Feb 3, 2026
PMB 5.6 - 'logid' SQL Injection
PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands through the 'logid' parameter. Attackers can leverage this vulnerability by sending crafted requests to the /admin/sauvegarde/download.php endpoint with manipulated logid values to interact with the database.