CVE-2023-32306

9.8 criticalEPSS 0.7%

Critical (9.8) in anuko time tracker. EPSS 0.7% chance of exploitation in the next 30 days.

Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2023-05-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

anuko:time_tracker

References

https://github.com/anuko/timetracker/security/advisories/GHSA-758x-vg7g-j9j3
https://github.com/anuko/timetracker/security/advisories/GHSA-758x-vg7g-j9j3

Check your stack JSON