Vulnerability · Published May 15, 2026 · Assigned by VulnCheck

CVE-2021-47966PHP Timeclock 1.04 SQL Injection via login.php

High 8.2

In plain English

A high-severity SQL injection in PHP Timeclock from Timeclock. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 80.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid parameter of login.php that allows unauthenticated attackers to extract database contents. Attackers can submit crafted POST requests with SQL payloads using SLEEP functions or RLIKE conditional statements to dump sensitive database information including employee names and credentials.

Affected products (as reported)

Vendor	Product	Versions
Timeclock	PHP Timeclock	1.04

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

ExploitDB-49849 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: PHP Timeclock 1.04 SQL Injection via login.php third-party-advisory