https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T19:10:42.885563+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-59920 CVE-2025-59920 — SQL injection in time@work from systems@work 2026-10-17T19:10:42.886679+00:00

Affected: systems at work time at work

When hours are entered in time@work, version 7.0.5, it performs a query to display the projects assigned to the user. If the query URL is copied and opened in a new browser window, the ‘IDClient’ parameter is vulnerable to a blind authenticated SQL injection. If the request is made with the TWAdmin user with the sysadmin role enabled, exploiting the vulnerability will allow commands to be executed on the system; if the user does not belong to the sysadmin role, they will still be able to query data from the database.