CVE-2026-100898
MediumCVSS 6.3Summary
In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1, the whereRaw function in the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the Timesheet Dashboard component is vulnerable to SQL injection via manipulation of the filter argument. The attack can be carried out remotely. The exploit is now public.
Risk Assessment
SQL injection may allow an attacker to gain unauthorized access to the database, steal data, or modify it.
Recommendation
Update the software to the latest available version and implement input validation.
Other vulnerabilities in DevaslanPHP project-management
See all- CVE-2026-100900Medium
In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1, the updateJiraProjects function in the /jira-import file of the Jira Import component leads to server-side request forgery via manipulation of host/username/token arguments. The attack can be initiated remotely. The exploit has been disclosed to the public.
- CVE-2026-100899Medium
In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1, the whereRaw function in the file app/Filament/Widgets/Timesheet/MonthlyReport.php of the Timesheet Dashboard component is vulnerable to SQL injection via manipulation of the filter argument. The attack may be performed remotely. The exploit has been published.
- CVE-2026-10285Medium
In DevaslanPHP project-management up to 2.0.0-beta1, an improper authorization vulnerability was found in the KanbanScrumHelper::recordUpdated function in app/Helpers/KanbanScrumHelper.php. The attack can be performed remotely. The project has not responded.
- CVE-2026-10284Medium
In DevaslanPHP project-management up to 2.0.0-beta1, an improper authorization vulnerability was found in the editComment/doDeleteComment functions in app/Filament/Resources/TicketResource/Pages/ViewTicket.php. The attack can be performed remotely. The project has not responded.
Original NVD description (English source)
A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1. This affects the function whereRaw of the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the component Timesheet Dashboard. Performing a manipulation of the argument filter results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS