{"id":"CVE-2021-47967","state":"PUBLISHED","title":"PHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters","description":"PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, or inject code through from_date and to_date parameters in report requests to execute scripts in user browsers.","publishedAt":"2026-05-15T18:36:33.208Z","updatedAt":"2026-05-24T01:37:16.512Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Timeclock PHP Timeclock"],"affected":[{"vendor":"Timeclock","product":"PHP Timeclock","versions":[{"version":"1.04","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/49853","http://timeclock.sourceforge.net","https://sourceforge.net/projects/timeclock/files/PHP%20Timeclock/PHP%20Timeclock%201.04/","https://www.vulncheck.com/advisories/php-timeclock-multiple-cross-site-scripting-via-parameters"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47967.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47967","state":"PUBLISHED","datePublished":"2026-05-15T18:36:33.208Z","dateUpdated":"2026-05-24T01:37:16.512Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-05-15T16:37:12.642Z"},"containers":{"cna":{"title":"PHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters","descriptions":[{"lang":"en","value":"PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, or inject code through from_date and to_date parameters in report requests to execute scripts in user browsers."}],"affected":[{"vendor":"Timeclock","product":"PHP Timeclock","versions":[{"version":"1.04","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/49853","name":"ExploitDB-49853","tags":["exploit"]},{"url":"http://timeclock.sourceforge.net","name":"Official Product Homepage","tags":["product"]},{"url":"https://sourceforge.net/projects/timeclock/files/PHP%20Timeclock/PHP%20Timeclock%201.04/","name":"Product Reference","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/php-timeclock-multiple-cross-site-scripting-via-parameters","name":"VulnCheck Advisory: PHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-05-24T01:37:16.512Z"},"credits":[{"lang":"en","value":"Tyler Butler","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-15T21:13:56.124242Z","id":"CVE-2021-47967","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-15T21:14:04.044Z"}}]}}}