Time tracker

This hub aggregates every CVE we track for Time tracker, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Time tracker.

• CVE-2025-9018Time Tracker <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Limited Data Deletion8.8Sep 11, 2025
• CVE-2025-10088SourceCodester Time Tracker index.html cross site scripting3.5Sep 8, 2025
• CVE-2023-32308SQL Injection Vulnerability in anuko timetracker8.2May 15, 2023
• CVE-2023-32306Time Tracker has Blind SQL Injection Vulnerability in Reports8.8May 12, 2023
• CVE-2023-32066Time Tracker has Stored XSS vulnerability in Week View plugin5.4May 9, 2023
• CVE-2022-24707SQL injection in anuko timetracker7.4Feb 23, 2022
• CVE-2022-24708Stored XSS vulnerability in anuko/timetracker6.5Feb 23, 2022
• CVE-2021-43851SQL injection vulnerability in anuko timetracker8.1Dec 21, 2021
• CVE-2021-41139Reflected XSS vulnerability in time.php8.1Oct 13, 2021
• CVE-2021-29436Cross site request forgery vulnerability5.4Apr 13, 2021
• CVE-2021-21352Predictable tokens used for password resets6.8Mar 3, 2021
• CVE-2020-27422In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.9.8Nov 16, 2020
• CVE-2020-27423Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox7.5Nov 16, 2020
• CVE-2020-15255CSV injection in Anuko Time Tracker8.7Oct 16, 2020
• CVE-2019-12162Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the or...7.8Jul 23, 2019