Time Tracker
16 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Time Tracker, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.
Time Tracker CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 2 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 16 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High9
- Medium4
- Low2
Latest CVEs
The 15 most recently published vulnerabilities affecting Time Tracker.
- CVE-2025-9018Time Tracker <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Limited Data Deletion8.8
- CVE-2025-10088SourceCodester Time Tracker index.html cross site scripting3.5
- CVE-2023-32308SQL Injection Vulnerability in anuko timetracker8.2
- CVE-2023-32306Time Tracker has Blind SQL Injection Vulnerability in Reports8.8
- CVE-2023-32066Time Tracker has Stored XSS vulnerability in Week View plugin5.4
- CVE-2022-24707SQL injection in anuko timetracker7.4
- CVE-2022-24708Stored XSS vulnerability in anuko/timetracker6.5
- CVE-2021-43851SQL injection vulnerability in anuko timetracker8.1
- CVE-2021-41139Reflected XSS vulnerability in time.php8.1
- CVE-2021-29436Cross site request forgery vulnerability5.4
- CVE-2021-21352Predictable tokens used for password resets6.8
- CVE-2020-27422In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.9.8
- CVE-2020-27423Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox7.5
- CVE-2020-15255CSV injection in Anuko Time Tracker8.7
- CVE-2019-12162Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the or...7.8
Product grouping is registry-driven, with AI assist and human review. How it works