CVE-2022-2026

The CVE-2022-2026 issue affects the open-source time-tracking project TITRA (kromitgmbh/titra). It is a Stored XSS vulnerability reported to exist in versions prior to 0.77.0, with multiple sources (NVD entry, Red Hat advisory, CVE lists) confirming stored XSS in user-input contexts (e.g., names/...

CVE-2022-2028

CVE-2022-2028 is a stored XSS vulnerability in the open-source time-tracking project titra (GitHub: kromitgmbh/titra) affecting versions prior to 0.77.0. The issue has been observed as a Stored XSS in the Project Name field (example payload provided), enabling injection when a project name is sav...

CVE-2022-2098

CVE-2022-2098 concerns weak password requirements in the GitHub repository kromitgmbh/titra, affecting versions prior to 0.78.1. The NVD entry documents a high-severity issue with CVSS 3.1: Network access, no authentication, and complex impact on Confidentiality, Integrity, and Availability (C:H/...

CVE-2022-2595

CVE-2022-2595 concerns the GitHub repository kromitgmbh/titra, affected in versions prior to 0.79.1. The root cause is improper authorization in the Add Extension functionality, which can allow a low-privilege/unauthenticated user to upload a malicious extension and trigger remote code execution....

CVE-2022-2027

CVE-2022-2027 concerns the GitHub project kromitgmbh/titra and describes an vulnerability in how CSV files are handled. The root cause is improper neutralization of formula elements in CSV content, enabling a potential CSV/Formula Injection. Affected versions are those prior to 0.77.0; the vulner...

CVE-2022-2029

CVE-2022-2029 affects the TITRA project (kromitgmbh/titra) prior to version 0.77.0. A DOM-based XSS issue is described, enabling script injection via the DOM handling in the web UI. The vulnerability is confirmed across multiple feeds (NVD, Red Hat, OSV, CVE records) with sources citing a DOM XSS...

CVE-2025-69288

CVE-2025-69288 affects Titra open source time-tracking software. Before version 0.99.49, an authenticated Admin can modify the timeEntryRule in the database, which is then passed to a NodeVM to execute as code, enabling Remote Code Execution. The issue is fixed in 0.99.49. Documents also referenc...

CVE-2026-21694

Titra (open‑source time tracking) has an Improper Access Control in versions 0.99.49 and earlier, enabling users to view/edit other users’ time entries in private projects. The issue affects the Titra APIs and is fixed in version 0.99.50. No exploitation details are provided in the sources; advis...

CVE-2026-21695

CVE-2026-21695 affects the open source time tracking software Titra. In versions ≤ 0.99.49, the API suffers a Mass Assignment vulnerability: the endpoint merges user-supplied input via the JavaScript spread operator into the database document (customfields), without validating which keys are perm...