Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 11 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
37added in the last 30 days
544new WordPress flaws this week
391,181entries in the database

37 results

  • Oct 12, 2026ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view proCVE-2026-109376 · Other software · Frappe · reported by VulnCheckMedium 5.3

    ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hide_timesheets and project membership, so attackers can retrieve timesheet names, status, time-log dates and last modifiers.

    Product
    ERPNext
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 20, 2026Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to CVE-2026-94113 · Other software · Frappe · reported by VulnCheckHigh 7.1

    Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.

    Product
    ERPNext
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 2, 2026Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team accCVE-2026-84808 · Other software · kimai · reported by VulnCheckMedium 5.3

    Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.

    Product
    kimai
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 26, 2026Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheeCVE-2026-80202 · Other software · kimai · reported by VulnCheckCritical 9.3

    Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a result, any authenticated user with ROLE_TEAMLEAD (or a role holding edit_other_timesheet/delete_other_timesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team membership. Timesheet IDs are sequential integers and trivially enumerable. ROLE_USER accounts are correctly restricted. (Note: the maintainers characterize this behavior as matching the documented permission model.)

    Product
    kimai
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 26, 2026Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipCVE-2026-80197 · Other software · kimai · reported by VulnCheckHigh 8.7

    Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their timesheet identifier, enabling cross-user business-state tampering without administrative privileges.

    Product
    kimai
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 26, 2026Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets.CVE-2026-80193 · Other software · kimai · reported by VulnCheckHigh 8.7

    Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassing authorization checks enforced elsewhere.

    Product
    kimai
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 11, 2026Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions.CVE-2019-25317 · Other software · kevinpapst · reported by VulnCheckMedium 5.1

    Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.

    Product
    Kimai
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 21, 2026The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users and attackers to injecCVE-2025-57681 · Other software · Thestarware · reported by MITREMedium 5.4

    The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users and attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability. The vulnerability is exploited via a specially crafted payload placed in an issue's summary field

    Product
    Worklogpro
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 20, 2026The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML oCVE-2025-67824 · Other software · reported by MITREMedium 6.1

    The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when the user attempts to create a timesheet with the filter timesheet type on the custom timesheet dialog because the filter name is not properly sanitized during the action.

    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 30, 2025In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which alCVE-2025-52049 · Other software · Frappe · reported by MITREMedium 6.5

    In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into the timelog parameter.

    Product
    Erpnext
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 8, 2025SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privilegeCVE-2025-42917 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5

    SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a significant impact on the application's integrity, while confidentiality and availability remain unaffected.

    Product
    SAP HCM (Approve Timesheets Fiori 2.0 application)
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 8, 2025Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privCVE-2025-42914 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.1

    Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform activities that are otherwise restricted, resulting in a low impact on the integrity of the application. Confidentiality and availability are not impacted.

    Product
    SAP HCM (My Timesheet Fiori 2.0 application)
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 8, 2025Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privCVE-2025-42913 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.1

    Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate privileges and perform activities that are otherwise restricted, resulting in a low impact on the integrity of the application. Confidentiality and availability are not impacted.

    Product
    SAP HCM (My Timesheet Fiori 2.0 application)
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 8, 2025SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2025-42912 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5

    SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a significant impact on the application's integrity, while confidentiality and availability remain unaffected.

    Product
    SAP HCM (My Timesheet Fiori 2.0 application)
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 9, 2024SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privilegeCVE-2024-47581 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3

    SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.There is low impact on integrity of the application. Confidentiality and availibility are not impacted.

    Product
    SAP HCM
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 17, 2023The TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view.CVE-2022-44726 · Other software · Timesheets-for-jira · reported by MITREMedium 5.4

    The TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view.

    Product
    Timesheet Tracking
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 27, 2022A vulnerability was found in dolibarr_project_timesheet up to 4.5.5.CVE-2022-4766 · Other software · Dolibarr Project Timesheet Project · reported by VulDBMedium 4.3

    A vulnerability was found in dolibarr_project_timesheet up to 4.5.5. It has been declared as problematic. This vulnerability affects unknown code of the component Form Handler. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. Upgrading to version 4.5.6.a is able to address this issue. The name of the patch is 082282e9dab43963e6c8f03cfaddd7921de377f4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216880.

    Product
    Dolibarr Project Timesheet
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 8, 2022CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai.CVE-2021-43515 · Other software · Kimai · reported by MITREHigh 7.8

    CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.

    Product
    Kimai
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 6, 2022OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`.CVE-2022-27108 · Other software · Orangehrm · reported by MITREMedium 4.3

    OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`. Any user can create a timesheet in another user's account.

    Product
    Orangehrm
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 27, 2019The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.CVE-2017-18590 · WordPress plugins & themes · reported by MITREMedium 6.1

    The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.

    Product
    timesheet
    Fixed in
    0.1.5
    What to do
    Update timesheet to 0.1.5 or newer.
  • Aug 23, 2019Kimai v2 before 1.1 has XSS via a timesheet description.CVE-2019-15481 · Other software · Kimai · reported by MITREMedium 6.1

    Kimai v2 before 1.1 has XSS via a timesheet description.

    Product
    Kimai 2
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 22, 2019The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.CVE-2017-18581 · WordPress plugins & themes · reported by MITREMedium 6.1

    The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.

    Product
    time-sheets
    Fixed in
    1.5.0
    What to do
    Update time-sheets to 1.5.0 or newer.
  • Jul 17, 2019Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS).CVE-2019-1010287 · Other software · Timesheet Next Gen · reported by josh@bress.netMedium 6.1

    Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url.

    Product
    Timesheet Next Gen
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 21, 2019Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserialization of untrusted user input from an auCVE-2018-20221 · Other software · Deltek · reported by MITREHigh 8.8

    Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the IIS Application Pool that is running the application.

    Product
    Ajera
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 19, 2012Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) username orCVE-2012-2105 · Other software · Peter Kovacs · reported by Red HatHigh 7.5

    Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.

    Product
    Timesheet Next GEN
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 26, 2011Multiple SQL injection vulnerabilities in the log-in form in Truworth Flex Timesheet allow remote attackers to execute arbitrary SQL commands via the (1) UsernaCVE-2010-4797 · Other software · Truworthit · reported by MITREHigh 7.5

    Multiple SQL injection vulnerabilities in the log-in form in Truworth Flex Timesheet allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.

    Product
    Flex Timesheet
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • May 28, 2010Cross-site request forgery (CSRF) vulnerability in user/user-set.do in Pacific Timesheet 6.74 build 363 allows remote attackers to hijack the authentication of CVE-2010-2111 · Other software · Pacifictimesheet · reported by MITREMedium 4.3

    Cross-site request forgery (CSRF) vulnerability in user/user-set.do in Pacific Timesheet 6.74 build 363 allows remote attackers to hijack the authentication of administrators for requests that create a new administrator via a new_admin action.

    Product
    Pacific Timesheet
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 10, 2009Directory traversal vulnerability in actions/downloadFile.php in Ultrize TimeSheet 1.2.2 allows remote attackers to read arbitrary files via a ..CVE-2009-3151 · Other software · Ultrize · reported by MITREMedium 5

    Directory traversal vulnerability in actions/downloadFile.php in Ultrize TimeSheet 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter.

    Product
    Timesheet
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 14, 2009PHP remote file inclusion vulnerability in include/timesheet.php in Ultrize TimeSheet 1.2.2, when register_globals is enabled, allows remote attackers to executCVE-2009-2769 · Other software · Ultrize · reported by MITREMedium 6.8

    PHP remote file inclusion vulnerability in include/timesheet.php in Ultrize TimeSheet 1.2.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the config[include_dir] parameter.

    Product
    Timesheet
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 2, 2009PHP remote file inclusion vulnerability in lib/onguma.class.php in the Onguma Time Sheet (com_ongumatimesheet20) 2.0 4b component for Joomla! allows remote attaCVE-2008-6347 · Other software · Luigi Massa · reported by MITREHigh 7.5

    PHP remote file inclusion vulnerability in lib/onguma.class.php in the Onguma Time Sheet (com_ongumatimesheet20) 2.0 4b component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

    Product
    Onguma Time Sheet
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 4, 2007Multiple SQL injection vulnerabilities in login.asp in Irola My-Time (aka Timesheet) 3.5 allow remote attackers to execute arbitrary SQL commands via the (1) loCVE-2007-6217 · Other software · Irola · reported by MITREHigh 7.5

    Multiple SQL injection vulnerabilities in login.asp in Irola My-Time (aka Timesheet) 3.5 allow remote attackers to execute arbitrary SQL commands via the (1) login (aka Username) and (2) password parameters. NOTE: some of these details are obtained from third party information.

    Product
    My-time
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 31, 2007Multiple PHP remote file inclusion vulnerabilities in lib/timesheet.class.php in Softerra Time-Assistant 6.2 and earlier, when register_globals is enabled, alloCVE-2007-1787 · Other software · Softerra · reported by MITREHigh 9.3

    Multiple PHP remote file inclusion vulnerabilities in lib/timesheet.class.php in Softerra Time-Assistant 6.2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) inc_dir or (2) lib_dir parameter.

    Product
    Time-assistant
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 12, 2006SQL injection vulnerability in login.php in dwayner79 and Dominic Gamble Timesheet (aka Timesheet.php) 1.2.1 allows remote attackers to execute arbitrary SQL coCVE-2006-4705 · Other software · Dominic Gamble · reported by MITREMedium 5

    SQL injection vulnerability in login.php in dwayner79 and Dominic Gamble Timesheet (aka Timesheet.php) 1.2.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.

    Product
    Timesheet.php
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 12, 2006Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier allow remote attackers to execute arbitraryCVE-2006-2982 · Other software · Enterprise Payroll Systems · reported by MITREHigh 7.5

    Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in (1) footer.php and (2) admin/footer.php.

    Product
    Enterprise Payroll Systems
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 12, 2006PHP remote file inclusion vulnerability in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier allows remote attackers to execute arbitrary PHP code CVE-2006-2983 · Other software · Enterprise Payroll Systems · reported by MITREHigh 7.5

    PHP remote file inclusion vulnerability in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the absolutepath parameter in cal.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

    Product
    Enterprise Payroll Systems
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 15, 2006Multiple SQL injection vulnerabilities in Carey Briggs PHP/MYSQL Timesheet 1 and 2 allow remote attackers to execute arbitrary SQL commands via the (1) yr, (2) CVE-2006-0692 · Other software · Carey Briggs · reported by MITREHigh 7.5

    Multiple SQL injection vulnerabilities in Carey Briggs PHP/MYSQL Timesheet 1 and 2 allow remote attackers to execute arbitrary SQL commands via the (1) yr, (2) month, (3) day, and (4) job parameters in (a) index.php and (b) changehrs.php.

    Product
    PHP Mysql Timesheet
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 18, 2002WorkforceROI Xpede 4.1 allows remote attackers to read user timesheets by modifying the TSN ID parameter to the ts_app_process.asp script, which is easily guessCVE-2002-0584 · Other software · Workforceroi · reported by MITREMedium 5

    WorkforceROI Xpede 4.1 allows remote attackers to read user timesheets by modifying the TSN ID parameter to the ts_app_process.asp script, which is easily guessable because it is incremented by 1 for each new timesheet.

    Product
    Xpede
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.