{"id":"CVE-2026-63497","published":"2026-11-09T22:18:53.640","lastModified":"2026-11-09T22:18:53.763","description":"titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-74"],"vendors":[],"products":[],"references":[{"url":"https://github.com/titraio/titra/security/advisories/GHSA-cphv-qx83-x397","tags":[]}],"exploitRefs":[{"url":"https://github.com/titraio/titra/security/advisories/GHSA-cphv-qx83-x397","tags":[]}],"hasPoc":true,"ai":null}