CVE-2019-12162

7.8 highEPSS 0.3%

High (7.8) in upwork time tracker. EPSS 0.3% chance of exploitation in the next 30 days.

Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe.

Severity

CVSS 3.0

7.8 high

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
CWE: CWE-494
Published: 2019-07-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

upwork:time_tracker

References

https://support.upwork.com/hc/en-us/categories/360001180954
https://vuldb.com/?id.138406
https://support.upwork.com/hc/en-us/categories/360001180954
https://vuldb.com/?id.138406

Check your stack JSON