The Online Project Time Management System Project maintains a web-based time-tracking application whose vulnerability profile centers on application-layer input-handling defects, including SQL injection, cross-site scripting, and unrestricted file uploads. These are typical risks in web applications where user input reaches database queries and rendered pages without adequate sanitization and validation. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Online Project Time Management System Project over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-26627HIGH Online Project Time Management System v1.0 was discovered to contain an arbitrary file write vulnerability which allows attackers to execute arbitrary code via a crafted HTML file. | Apr 7, 2022 | 8.8 | 29 | NO | NO |
CVE-2021-46451CRITICAL An SQL Injection vulnerabilty exists in Sourcecodester Online Project Time Management System 1.0 via the pid parameter in the load_file function. | Jan 24, 2022 | 9.8 | 29 | NO | NO |
CVE-2022-26293CRITICAL Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function save_employee at /ptms/classes/Users.php. | Mar 16, 2022 | 9.8 | 24 | NO | NO |
CVE-2022-26295MEDIUM A stored cross-site scripting (XSS) vulnerability in /ptms/?page=user of Online Project Time Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a | Mar 16, 2022 | 5.4 | 20 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Online Project Time Management System Project.
Media articles that mention a CVE ID that affects a product developed by Online Project Time Management System Project — matched by CVE ID, not by vendor name.