CVE-2026-100899

Name of the Vulnerable Software and Affected Versions DevaslanPHP project-management versions 1.2.1 through 1.2.4 DevaslanPHP project-management version v2.0.0-beta1

Description A remote SQL injection exists in the Timesheet Dashboard component within the whereRaw() function of the app/Filament/Widgets/Timesheet/MonthlyReport.php file. This issue occurs when the filter argument is manipulated, allowing an attacker to execute unauthorized SQL commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the Timesheet Dashboard component to minimize the risk of exploitation.