CVE-2020-15255— CSV injection in Anuko Time Tracker
Quick assessment
Affected
anuko timetracker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Anuko Time Tracker是个人开发者的一个开源的时间统计系统。用于统计员工在各个工作上花费时间的一个平台。 Anuko Time Tracker 1.19.23.5325之前版本存在安全漏洞，该漏洞源于没有正确过滤用户输入，报表的CSV导出可能包含被电子表格软件当作公式处理的单元格(例如，当单元格值以等号开始时)。
Public Exploits 1
ExploitDB · 1
EDB-49027 [webapps]
Possible ATT&CK Techniques 1 AI
T1195 · Supply Chain Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-15255
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CSV injection in Anuko Time Tracker
Source: CVE Program / CVE List V5
Vulnerability Description
In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fixed in version 1.19.23.5325.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Anuko Time Tracker 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Anuko Time Tracker是个人开发者的一个开源的时间统计系统。用于统计员工在各个工作上花费时间的一个平台。 Anuko Time Tracker 1.19.23.5325之前版本存在安全漏洞，该漏洞源于没有正确过滤用户输入，报表的CSV导出可能包含被电子表格软件当作公式处理的单元格(例如，当单元格值以等号开始时)。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| anuko | timetracker | < 1.19.23.5325 | - |
|
II. Public POCs for CVE-2020-15255
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-15255
请登录查看更多情报信息。
Patches & Fixes for CVE-2020-15255 (1)
Vendor Advisories for CVE-2020-15255 (1)
-
https://github.com/anuko/timetracker/security/advisories/GHSA-prjf-9mgh-8fpv x_refsource_CONFIRM
Exploits & Public PoCs for CVE-2020-15255 (2)
-
https://www.exploit-db.com/exploits/49027 x_refsource_MISC
IV. Related Vulnerabilities
Same product: timetracker
-
CVE-2023-32308
SQL Injection Vulnerability in anuko timetracker -
CVE-2023-32306
Time Tracker has Blind SQL Injection Vulnerability in Report -
CVE-2023-32066
Time Tracker has Stored XSS vulnerability in Week View plugi -
CVE-2022-24707
SQL injection in anuko timetracker -
CVE-2022-24708
Stored XSS vulnerability in anuko/timetracker
Same vendor: anuko
-
CVE-2023-32308
SQL Injection Vulnerability in anuko timetracker -
CVE-2023-32306
Time Tracker has Blind SQL Injection Vulnerability in Report -
CVE-2023-32066
Time Tracker has Stored XSS vulnerability in Week View plugi -
CVE-2022-24707
SQL injection in anuko timetracker -
CVE-2022-24708
Stored XSS vulnerability in anuko/timetracker
Same weakness: CWE-74
-
CVE-2026-12717
Remote Code Execution in BigQuery Data Transfer Service via -
CVE-2026-79234
Chrome低于152.0.7977.65存在CSS注入漏洞 -
CVE-2026-79087
Chrome<152.0.7977.65标签页注入漏洞 -
CVE-2026-53572
KEDA: PostgreSQL connection string parameter injection via i -
CVE-2026-76993
GreyDGL PentestGPT Web-Page Crawling injection
V. Comments for CVE-2020-15255
No comments yet