Vulnerability · Published May 15, 2026 · Assigned by VulnCheck

CVE-2021-47967PHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters

Medium 6.1

In plain English

A medium-severity cross-site scripting in PHP Timeclock from Timeclock. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 88.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, or inject code through from_date and to_date parameters in report requests to execute scripts in user browsers.

Affected products (as reported)

Vendor	Product	Versions
Timeclock	PHP Timeclock	1.04

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

ExploitDB-49853 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: PHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters third-party-advisory