Time Tracker
Vendor:
First CVE: Oct 16, 2020 · Active for 5 years
12
Total CVEs
More Total CVEs than 90% of tracked products
3.0
Avg CVEs / Year
Higher CVE frequency than 76% of tracked products
8.0
Avg CVSS
Higher Avg CVSS than 69% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Time Tracker over time
Volume of CVEsAvg CVSS Base Score
First CVE
Oct 16, 2020
5 years ago
Most Recent CVE
May 15, 2023
1,167 days ago
CVE Severity & Scoring
Time Tracker12 CVEs
25%
42%
33%
All CVEs352,708 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local1 (8.3%)
Network11 (91.7%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low12 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None7 (58.3%)
Unknown0 (0.0%)
Required5 (41.7%)
Privileges Required
Low5 (41.7%)
High0 (0.0%)
None7 (58.3%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-27422CRITICAL In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account. | Nov 16, 2020 | 9.8 | 45 | NO | YES |
CVE-2022-24707HIGH Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker | Feb 24, 2022 | 8.8 | 42 | NO | YES |
CVE-2020-27423HIGH Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox | Nov 16, 2020 | 7.5 | 35 | NO | YES |
CVE-2023-32308CRITICAL anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. Th | May 15, 2023 | 9.8 | 29 | NO | NO |
CVE-2023-32306CRITICAL Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happenin | May 12, 2023 | 9.8 | 29 | NO | NO |
CVE-2021-43851HIGH Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker version 1.19.33.5606 a | Dec 22, 2021 | 8.8 | 28 | NO | NO |
CVE-2020-15255HIGH In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet s | Oct 16, 2020 | 7.3 | 28 | NO | YES |
CVE-2021-21352CRITICAL Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time T | Mar 3, 2021 | 9.1 | 26 | NO | NO |
CVE-2021-29436HIGH Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerabil | Apr 13, 2021 | 8.1 | 24 | NO | NO |
CVE-2021-41139MEDIUM Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being passed on via the date p | Oct 13, 2021 | 6.1 | 21 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (12 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
4 CVEs
33.3% of CVEs· 90th percentile
Social Chatter
Signals from CVEs in this product scope (12 CVEs).
Media Mentions
Signals from CVEs in this product scope (12 CVEs).
Top CNAs Publishing CVEs For Time Tracker
Top CWEs
Versions
No cataloged versions.