CVE-2025-69288

CRITICAL

Kromit Titra < 0.99.49 - Improper Input Validation

Title source: rule

Description

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.

References (3)

Scores

CVSS v3 9.1
EPSS 0.0081
EPSS Percentile 74.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Classification

CWE
CWE-20
Status published

Affected Products (1)

kromit/titra < 0.99.49

Timeline

Published Dec 31, 2025
Tracked Since Feb 18, 2026