CVE-2026-100899
MediumCVSS 6.3Summary
In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1, the whereRaw function in the file app/Filament/Widgets/Timesheet/MonthlyReport.php of the Timesheet Dashboard component is vulnerable to SQL injection via manipulation of the filter argument. The attack may be performed remotely. The exploit has been published.
Risk Assessment
SQL injection may allow an attacker to gain unauthorized access to the database, steal data, or modify it.
Recommendation
Update the software to the latest available version and implement input validation.
Other vulnerabilities in DevaslanPHP project-management
See all- CVE-2026-100900Medium
In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1, the updateJiraProjects function in the /jira-import file of the Jira Import component leads to server-side request forgery via manipulation of host/username/token arguments. The attack can be initiated remotely. The exploit has been disclosed to the public.
- CVE-2026-100898Medium
In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1, the whereRaw function in the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the Timesheet Dashboard component is vulnerable to SQL injection via manipulation of the filter argument. The attack can be carried out remotely. The exploit is now public.
- CVE-2026-10285Medium
In DevaslanPHP project-management up to 2.0.0-beta1, an improper authorization vulnerability was found in the KanbanScrumHelper::recordUpdated function in app/Helpers/KanbanScrumHelper.php. The attack can be performed remotely. The project has not responded.
- CVE-2026-10284Medium
In DevaslanPHP project-management up to 2.0.0-beta1, an improper authorization vulnerability was found in the editComment/doDeleteComment functions in app/Filament/Resources/TicketResource/Pages/ViewTicket.php. The attack can be performed remotely. The project has not responded.
Original NVD description (English source)
A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. This impacts the function whereRaw of the file app/Filament/Widgets/Timesheet/MonthlyReport.php of the component Timesheet Dashboard. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS