CVE-2021-41156

anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few pages to collect the today's date from user browsers. Because of not checking this parameter for sanity in versions prior to 1.19.30.5601, it was possible to craft an html form with malicious JavaScript, use social engineering to convince logged on users to execute a POST from such form, and have the attacker-supplied JavaScript to be executed in user's browser. This has been patched in version 1.19.30.5600. Upgrade is recommended. If it is not practical, introduce ttValidDbDateFormatDate function as in the latest version and add a call to it within the access checks block.

• CWE-79
• CWE-79

• https://github.com/anuko/timetracker/security/advisories/GHSA-g9cc-m4p4-6xpcThird Party Advisory
• https://github.com/anuko/timetracker/security/advisories/GHSA-g9cc-m4p4-6xpcThird Party Advisory

Published

Oct 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41150Tough provides a set of Rust libraries and tools for using a…6.5
• CVE-2021-41151Backstage is an open platform for building developer portals…4.9
• CVE-2021-41152OpenOlat is a web-based e-learning platform for teaching, le…7.7
• CVE-2021-41153The evm crate is a pure Rust implementation of Ethereum Virt…9.8
• CVE-2021-41154Tuleap is a Free & Open Source Suite to improve management o…8.8
• CVE-2021-41155Tuleap is a Free & Open Source Suite to improve management o…8.8
• CVE-2021-41157FreeSWITCH is a Software Defined Telecom Stack enabling the …5.3
• CVE-2021-41158FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2021-41159FreeRDP is a free implementation of the Remote Desktop Proto…8.8
• CVE-2021-4116yetiforcecrm is vulnerable to Improper Neutralization of Inp…5.4
• CVE-2021-41160FreeRDP is a free implementation of the Remote Desktop Proto…8.8
• CVE-2021-41161Combodo iTop is a web based IT Service Management tool. In v…6.1