CVE-2026-100898

Name of the Vulnerable Software and Affected Versions DevaslanPHP project-management versions 1.2.1 through 1.2.4 DevaslanPHP project-management version 2.0.0-beta1

Description Remote SQL injection is possible within the Timesheet Dashboard component. The issue exists in the whereRaw() function located in the app/Filament/Widgets/Timesheet/ActivitiesReport.php file, where manipulating the filter argument allows for the execution of arbitrary SQL commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the Timesheet Dashboard component to minimize the risk of exploitation.