Skip to content
OpenAdvisories

Vendor

anuko

11 known vulnerabilities.

anuko at a glance

Last 12 months
0
Critical · all time
0
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

timetracker 11
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • High 8.2
    CVE-2023-32308

    SQL Injection Vulnerability in anuko timetracker

    anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST …

    anuko timetracker
  • High 8.8
    CVE-2023-32306

    Time Tracker has Blind SQL Injection Vulnerability in Reports

    Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requ…

    anuko timetracker
  • Medium 5.4
    CVE-2023-32066

    Time Tracker has Stored XSS vulnerability in Week View plugin

    Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements …

    anuko timetracker
  • High 7.4
    CVE-2022-24707 Public exploit

    SQL injection in anuko timetracker

    Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was…

    anuko timetracker
  • Medium 6.5
    CVE-2022-24708

    Stored XSS vulnerability in anuko/timetracker

    Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to …

    anuko timetracker
  • High 8.1
    CVE-2021-43851

    SQL injection vulnerability in anuko timetracker

    Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker version 1.19.33.5606 and prior due to not properly checking of the "group" and "status" parameters in…

    anuko timetracker
  • Medium 6.8
    CVE-2021-41156

    Reflected XSS vulnerability

    anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior t…

    anuko timetracker
  • High 8.1
    CVE-2021-41139

    Reflected XSS vulnerability in time.php

    Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being passed on via the date parameter in URI. Because of not checking this parameter for sanity in versions …

    anuko timetracker
  • Medium 5.4
    CVE-2021-29436

    Cross site request forgery vulnerability

    Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by soci…

    anuko timetracker
  • Medium 6.8
    CVE-2021-21352

    Predictable tokens used for password resets

    Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a w…

    anuko timetracker
  • High 8.7
    CVE-2020-15255 Public exploit

    CSV injection in Anuko Time Tracker

    In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fix…

    anuko timetracker