PT-2026-41346 · Timeclock · Php Timeclock

Tyler Butler · Publicado 2026-05-15 · Atualizado 2026-05-15 · CVE-2021-47967

NVD

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, or inject code through from date and to date parameters in report requests to execute scripts in user browsers.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2021-47967

Produtos afetados

Php Timeclock

Referências · 5

• 🔥 https://exploit-db.com/exploits/49853 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47967 · Nota de Segurança
• https://vulncheck.com/advisories/php-timeclock-multiple-cross-site-scripting-via-parameters · Nota
• http://timeclock.sourceforge.net · Nota
• https://sourceforge.net/projects/timeclock/files/PHP%20Timeclock/PHP%20Timeclock%201.04 · Nota