CVE-2025-69288

CriticalCVSS 9.1/10Last modified Sep 23, 2026

Description

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
kromitgmbh	titra	< 0.99.49

References

https://github.com/kromitgmbh/titra/commit/2e2ac5cbeed47a76720b21c7fde0214a242e065ePatch
https://github.com/kromitgmbh/titra/releases/tag/0.99.49Release Notes
https://github.com/kromitgmbh/titra/security/advisories/GHSA-pqgx-6wg3-gmvrExploit, Mitigation, Vendor Advisory
https://github.com/kromitgmbh/titra/security/advisories/GHSA-pqgx-6wg3-gmvrExploit, Mitigation, Vendor Advisory

Timeline

Published: Dec 31, 2025
Last modified: Sep 23, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-692895.4Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and CVE-2025-69298.8A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing CVE-2025-692928.8Incorrect Privilege Assignment vulnerability in e-plugins WP Membership wp-membership allows Privilege Escalation.This issue affects WP Memb CVE-2025-692938.8Incorrect Privilege Assignment vulnerability in e-plugins Final User final-user allows Privilege Escalation.This issue affects Final User: f CVE-2025-692948.8Deserialization of Untrusted Data vulnerability in fuelthemes PeakShops peakshops allows Object Injection.This issue affects PeakShops: from CVE-2025-692959.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Coven Core coven-core all CVE-2025-692967.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhostPool Aardvark aardvark allows Ref CVE-2025-692977.5Missing Authorization vulnerability in GhostPool Aardvark Plugin aardvark-plugin allows Exploiting Incorrectly Configured Access Control Sec CVE-2025-692987.5Missing Authorization vulnerability in GhostPool Gauge gauge allows Exploiting Incorrectly Configured Access Control Security Levels.This is CVE-2025-692997.2Server-Side Request Forgery (SSRF) vulnerability in Laborator Oxygen oxygen allows Server Side Request Forgery.This issue affects Oxygen: fr CVE-2025-69308.8A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /CVE-2025-693005.4Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Config