CVE-2025-69288

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.

• CWE-20

• https://github.com/kromitgmbh/titra/commit/2e2ac5cbeed47a76720b21c7fde0214a242e065ePatch
• https://github.com/kromitgmbh/titra/releases/tag/0.99.49Release Notes
• https://github.com/kromitgmbh/titra/security/advisories/GHSA-pqgx-6wg3-gmvrExploit, Mitigation, Vendor Advisory
• https://github.com/kromitgmbh/titra/security/advisories/GHSA-pqgx-6wg3-gmvrExploit, Mitigation, Vendor Advisory

Published

Dec 31, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69278In nr modem, there is a possible system crash due to imprope…7.5
• CVE-2025-69279In nr modem, there is a possible system crash due to imprope…7.5
• CVE-2025-69284Plane is an an open-source project management tool. In plane…4.3
• CVE-2025-69285SQLBot is an intelligent data query system based on a large …6.1
• CVE-2025-69286RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…9.8
• CVE-2025-69287The BSV Blockchain SDK is a unified TypeScript SDK for devel…5.4
• CVE-2025-69289Discourse is an open source discussion platform. A privilege…5.4
• CVE-2025-6929A vulnerability was found in PHPGurukul Zoo Management Syste…8.8
• CVE-2025-69290Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2025-69291Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2025-69292Incorrect Privilege Assignment vulnerability in e-plugins WP…8.8
• CVE-2025-69293Incorrect Privilege Assignment vulnerability in e-plugins Fi…8.8