Plugin icon

Zephyr Project Manager

zephyr-project-manager

Vulnerabilities:

19

Last Updated:

February 11, 2026

Active Installs:

1000

Published
Title
Fixed in
CVSS
Published
2025-12-16
Title
Zephyr Project Manager < 3.3.204 - Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery
Fixed in
Fixed in 3.3.204
CVSS
4.9 (medium)
Published
2025-09-25
Title
Zephyr Project Manager < 3.3.203 - Authenticated (Admin+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.3.203
CVSS
4.4 (medium)
Published
2025-08-26
Title
Zephyr Project Manager < 3.3.202 - Missing Authorization
Fixed in
Fixed in 3.3.202
CVSS
4.3 (medium)
Published
2025-04-16
Title
Zephyr Project Manager < 3.3.201 - Missing Authorization
Fixed in
Fixed in 3.3.201
CVSS
4.3 (medium)
Published
2025-04-10
Title
Zephyr Project Manager < 3.3.102 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.3.102
CVSS
6.1 (medium)
Published
2024-08-20
Title
Zephyr Project Manager < 3.3.103 - Missing Authorization to Authenticated (Subscriber+) Status Updates
Fixed in
Fixed in 3.3.103
CVSS
4.3 (medium)
Published
2024-08-20
Title
Zephyr Project Manager < 3.3.103 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.3.103
CVSS
5.5 (medium)
Published
2024-08-16
Title
Zephyr Project Manager < 3.3.101 - Authenticated (Subscriber+) Insecure Direct Object Reference
Fixed in
Fixed in 3.3.101
CVSS
4.3 (medium)
Published
2024-08-14
Title
Zephyr Project Manager < 3.3.102 - Authenticated (Subscriber+) Limited Privilege Escalation
Fixed in
Fixed in 3.3.102
CVSS
8.1 (high)
Published
2024-08-02
Title
Zephyr Project Manager < 3.3.101 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter
Fixed in
Fixed in 3.3.101
CVSS
6.4 (medium)
Published
2024-07-12
Title
Zephyr Project Manager < 3.3.100 - Unauthenticated Information Exposure
Fixed in
Fixed in 3.3.100
CVSS
5.3 (medium)
Published
2024-07-09
Title
Zephyr Project Manager < 3.3.99 - Editor+ XSS
Fixed in
Fixed in 3.3.99
CVSS
3.5 (low)
Published
2024-07-04
Title
Zephyr Project Manager < 3.3.99 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update
Fixed in
Fixed in 3.3.99
CVSS
8.8 (high)
Published
2023-06-13
Title
Zephyr Project Manager < 3.3.94 - Plugin Data Deletion via CSRF
Fixed in
Fixed in 3.3.94
CVSS
5.4 (medium)
Published
2022-09-08
Title
Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSS
Fixed in
Fixed in 3.2.55
CVSS
8.3 (high)
Published
2022-08-29
Title
Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi
Fixed in
Fixed in 3.2.5
CVSS
9.3 (critical)
Published
2022-08-29
Title
Zephyr Project Manager < 3.2.5 - Unauthorised REST Calls to Stored XSS
Fixed in
Fixed in 3.2.5
CVSS
8.3 (high)
Published
2022-08-29
Title
Zephyr Project Manager < 3.2.5 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.2.5
CVSS
6.1 (medium)
Published
2022-05-23
Title
Zephyr Project Manager < 3.2.41 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.2.41
CVSS
6.1 (medium)