Read the docs
TI-2020-12027 Aliases CVE-2020-15255

CSV injection in Anuko Time Tracker

Priority MEDIUM 44CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fixed in version 1.19.23.5325.

Why it matters now

EPSS 0.03504 89th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed timetracker (anuko): 1.19.23.5325

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
anukotimetrackerbefore 1.19.23.53251.19.23.5325Patch availableCNA
  • timetracker Vendoranuko Affected before 1.19.23.5325 Fixed in 1.19.23.5325 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:*before 1.19.23.5325Vulnerableanuko
  • cpe:2.3:a:anuko:time_tracker:*:*:*:*:*:*:*:* Versions before 1.19.23.5325 Vulnerable ·anuko

Remediation

  • Fix · CNA timetracker (anuko) Fixed in 1.19.23.5325

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15255

References

Exploit 2

Patch 1

Advisory 1

  • TI-2022-08522 SQL injection in anuko timetracker CVSS 3.1HIGH 8.8
  • TI-2020-16665 In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't… CVSS 3.1CRITICAL 9.8
  • TI-2023-15602 SQL Injection Vulnerability in anuko timetracker CVSS 3.1CRITICAL 9.8
  • TI-2023-15600 Time Tracker has Blind SQL Injection Vulnerability in Reports CVSS 3.1CRITICAL 9.8
  • TI-2021-04452 Predictable tokens used for password resets CVSS 3.1CRITICAL 9.1
  • TI-2020-16666 Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which… CVSS 3.1HIGH 7.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences