Starware WorklogPRO – Jira Timesheets security vulnerabilities

The Starware WorklogPRO – Jira Timesheets is a time tracking plugin developed by The Starware company in Turkey. Versions of The Starware WorklogPRO – Jira Timesheets prior to 4.24.1-jira9, 4.24.1-jira10, and 4.24.1-jira11 contained security vulnerabilities. These vulnerabilities were caused by...

CVE-2025-67824

The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when t...

CVE-2025-67824

The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when t...

CVE-2025-67824

The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when t...

CVE-2025-67824

The WorklogPRO - Jira Timesheets plugin for Jira Data Center is vulnerable to Cross-Site Scripting (XSS) in versions prior to 4.24.2-jira9 , 4.24.2-jira10 , and 4.24.2-jira11 . The root cause is the improper sanitization of the filter name during actions. Attackers can inject arbitrary HTML or Ja...

CVE-2025-67824: Improper Neutralization of Input During Web Page Generation

The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when t...