PT-2025-47333 · Times · Times Software E-Payroll

Sebastian Jeż · Published 2025-11-18 · Updated 2025-11-19 · CVE-2025-9977

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Times Software E-Payroll (affected versions not specified)

Description The application does not properly sanitize data received in POST parameters during the login process, potentially allowing an unauthenticated attacker to perform Denial-of-Service (DoS) attacks. While SQL injection attacks are possible, backend filtering mechanisms may currently prevent successful exploitation. Command injection attempts result in the application displaying detailed error messages that reveal information about the internal infrastructure. The vendor has not responded to inquiries regarding patching status.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Generation of Error Message Containing Sensitive Information

SQL injection

Weakness Enumeration

CWE-209

CWE-89

Related Identifiers

CVE-2025-9977

Affected Products

Times Software E-Payroll

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-9977 · Security Note
• https://timesoftsg.com.sg/payroll-software · Note
• https://twitter.com/VulmonFeeds/status/1990938486883446927 · Twitter Post
• https://cert.pl/en/posts/2025/11/CVE-2025-9977 · Note
• https://twitter.com/CVEnew/status/1991042986847748554 · Twitter Post