PT-2026-60086

Summary GET /api/timesheets?user= and users= returns the targeted user's timesheet records to any caller that has the view other timesheet permission, without verifying that the caller is teamlead of any team containing the target user. The per-record endpoint GET /api/timesheets/id correctly...

EUVD-2002-0579

Malware in sbrugna...

EUVD-2006-4692

Malware in sbrugna...

EUVD-2022-31647

Malicious code in bioql PyPI...

CVE-2022-27108

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...