Testlink is an open-source test-management platform deployed across software development and quality-assurance teams, with a narrow product footprint that belies its presence in the broader vulnerability landscape. Vulnerabilities affecting the platform skew toward serious outcomes, with an elevated share reaching critical severity, and frequently acquire public exploit code; the exposure recurs consistently through input-handling flaws including SQL injection, cross-site scripting, code injection, and sensitive-information exposure that are characteristic of web-facing applications. These weakness classes reflect the challenges of sanitizing user input and controlling code generation in a platform designed for collaborative test orchestration and reporting. Defenders should treat this vendor's advisories as high-priority for exposed instances and prioritize network isolation of test infrastructure; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Testlink over time
Signals from CVEs in this vendor scope (27 CVEs).
27 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-8639HIGH An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute arbitrary code by uploading a file with an executable extensio | Apr 3, 2020 | 8.8 | 47 | NO | YES |
CVE-2014-5308HIGH Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/pr | Oct 8, 2014 | 9.0 | 41 | NO | YES |
CVE-2018-7466HIGH install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES data during installation to provi | Feb 25, 2018 | 7.5 | 39 | NO | YES |
CVE-2020-8638CRITICAL A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in planUrgency.php via the urgency parameter. | Apr 3, 2020 | 9.8 | 33 | NO | NO |
CVE-2012-0938MEDIUM Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the ro | Aug 14, 2014 | 6.5 | 33 | NO | YES |
CVE-2020-8637CRITICAL A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id parameter. | Apr 3, 2020 | 9.8 | 31 | NO | NO |
CVE-2022-35196HIGH TestLink v1.9.20 was discovered to contain a Cross-Site Request Forgery (CSRF) via /lib/plan/planView.php. | Sep 20, 2022 | 8.8 | 28 | NO | NO |
CVE-2020-8841HIGH An issue was discovered in TestLink 1.9.19. The relation_type parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection. | Feb 10, 2020 | 8.8 | 28 | NO | NO |
CVE-2019-20107HIGH Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsV | Mar 5, 2020 | 8.8 | 27 | NO | NO |
CVE-2022-35195HIGH TestLink 1.9.20 Raijin was discovered to contain a broken access control vulnerability at /lib/attachments/attachmentdownload.php | Sep 16, 2022 | 7.2 | 24 | NO | NO |
Signals from CVEs in this vendor scope (27 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Testlink.
Media articles that mention a CVE ID that affects a product developed by Testlink — matched by CVE ID, not by vendor name.