Anuko develops a time-tracking application that sits at the intersection of web-based productivity and data-handling systems, a position that exposes it to injection and request-forgery attack surfaces. Its vulnerability profile skews strongly toward critical-severity outcomes and frequently acquires public exploit code, clustering around input-validation and output-encoding weaknesses—SQL injection, cross-site scripting, CSRF, and formula-injection flaws—that are endemic to web applications processing user-supplied data and generating structured output. Defenders should prioritize patching this vendor's releases and restrict direct internet exposure of time-tracking instances; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Anuko over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-27422CRITICAL In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account. | Nov 16, 2020 | 9.8 | 45 | NO | YES |
CVE-2022-24707HIGH Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker | Feb 24, 2022 | 8.8 | 42 | NO | YES |
CVE-2020-27423HIGH Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox | Nov 16, 2020 | 7.5 | 35 | NO | YES |
CVE-2023-32308CRITICAL anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. Th | May 15, 2023 | 9.8 | 29 | NO | NO |
CVE-2023-32306CRITICAL Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happenin | May 12, 2023 | 9.8 | 29 | NO | NO |
CVE-2021-43851HIGH Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker version 1.19.33.5606 a | Dec 22, 2021 | 8.8 | 28 | NO | NO |
CVE-2020-15255HIGH In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet s | Oct 16, 2020 | 7.3 | 28 | NO | YES |
CVE-2021-21352CRITICAL Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time T | Mar 3, 2021 | 9.1 | 26 | NO | NO |
CVE-2021-29436HIGH Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerabil | Apr 13, 2021 | 8.1 | 24 | NO | NO |
CVE-2021-41139MEDIUM Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being passed on via the date p | Oct 13, 2021 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Anuko.
Media articles that mention a CVE ID that affects a product developed by Anuko — matched by CVE ID, not by vendor name.