CRITICAL🇵🇱 Wersja polska

CVE-2025-69288

CVSS 9.1v3.1pub. 2025-12-31upd. 2026-01-13

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Kromit Titra

    APP
    Kromit
    < 0.99.49
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2022-2595CRITICAL10.0ten sam produkt

Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.

CVE-2022-2098CRITICAL9.8ten sam produkt

Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1.

CVE-2022-2027HIGH8.0ten sam produkt

Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77....

CVE-2026-21695MEDIUM4.3ten sam produkt

Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignme...

CVE-2026-21694MEDIUM6.8ten sam produkt

Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, ...