Back to Database
Status published
Critical
CVE-2025-69288
Titra has Remote Code Execution in Admin Functionality
Vulnerability Description
Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-69288
Credits & Attribution
No credits recorded in the NVD database.
References
More from kromitgmbh
View All →CVE-2022-2595
Improper Authorization in kromitgmbh/titra
Critical
9.8
CVE-2022-2098
Weak Password Requirements in kromitgmbh/titra
High
7.1
CVE-2022-2029
Cross-site Scripting (XSS) - DOM in kromitgmbh/titra
High
8.2
CVE-2022-2028
Cross-site Scripting (XSS) - Generic in kromitgmbh/titra
High
8.2
CVE-2022-2027
Improper Neutralization of Formula Elements in a CSV File in kromitgmbh/titra
High
8
Affected Vendor
kromitgmbh
View all reports →Affected Software
titra
Vulnerable Versions:
< 0.99.49
Timeline
Official Publish:
December 31st, 2025
Last Modified:
January 2nd, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H