CVE-2021-47967

Description

PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, or inject code through from_date and to_date parameters in report requests to execute scripts in user browsers.

Overview

State

—

Assigner (CNA)

—

CVSS severity

medium

CVSS score

6.1 / 10

CVSS vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Effective score

6.1 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2021-47967

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-05-15 19:16:56 UTC

NVD last modified

2026-05-18 17:33:27 UTC

NVD CVSS v3.1

6.1 / 10 MEDIUM source: disclosure@vulncheck.com

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability subscore

2.8 / 10

Impact subscore

2.7 / 10

EPSS score

0.0009 (probability of exploitation in next 30 days)

EPSS percentile

26.11% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD-assigned CWE(s): CWE-79 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2021-34822

Assigner

VulnCheck

Published

May 15, 2026, 6:36:33 PM

Updated

May 24, 2026, 1:37:16 AM

EUVD base score (CVSS 4.0)

5.1 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EUVD-reported EPSS

0.1000

Vendors

Timeclock

Products

PHP Timeclock (1.04)

Aliases

GHSA-9cv2-qjw6-qv9j

ENISA description: PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, or inject code through from_date and to_date parameters in report requests to execute scripts in user browsers.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (7)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• http://timeclock.sourceforge.net tenable:timeclock.sourceforge.net
• https://nvd.nist.gov/vuln/detail/CVE-2021-47967 tenable:nvd.nist.gov
• https://sourceforge.net/projects/timeclock/files/PHP%20Timeclock/PHP%20Timeclock%201.04/ tenable:sourceforge.net
• https://www.cve.org/CVERecord?id=CVE-2021-47967 tenable:www.cve.org
• https://www.exploit-db.com/exploits/49853 tenable:www.exploit-db.com
• https://www.first.org/epss/ tenable:www.first.org
• https://www.vulncheck.com/advisories/php-timeclock-multiple-cross-site-scripting-via-parameters tenable:www.vulncheck.com

• CWE - Common Weakness Enumeration
  web:cwe.mitre.org

  Common Weakness Enumeration (CWE) is a list of software and hardware weaknesses.

  2026-05-26 03:08 UTC
• Security Update Guide - Microsoft
  web:msrc.microsoft.com

  The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

  2026-05-26 03:08 UTC
• Android Security Bulletins - Android Open Source Project
  web:source.android.com

  This Section contains the available Android Security Bulletins, which provide fixes for possible issues affecting Android devices.

  2026-05-26 03:08 UTC
• Google Translate
  web:translate.google.com

  Google's service, offered free of charge, instantly translates words, phrases, and web pages between English and over 100 other languages.

  2026-05-26 03:08 UTC
• CVE: Common Vulnerabilities and Exposures
  web:www.cve.org

  At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

  2026-05-26 03:08 UTC
• How to Fix the "Your Device Is Missing Important Security and Quality ...
  web:www.howtogeek.com

  In this case, use your PC's built-in Windows Update troubleshooter to automatically find and fix issues with your updates. Only a little interaction is required from your end. To run that tool, go to Settings > Update & Security > Troubleshoot > Additional Troubleshooters > Windows Update and click "Run the Troubleshooter".

  2026-05-26 03:08 UTC
• National Vulnerability Database | NIST
  web:www.nist.gov

  NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation's cybersecurity infrastructure.

  2026-05-26 03:08 UTC
• Critical Patch Updates, Critical Security Patch Updates ... - Oracle
  web:www.oracle.com

  Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.

  2026-05-26 03:08 UTC
• Microsoft fixes 167 security flaws in April, second biggest Patch ...
  web:www.pcworld.com

  This month's Patch Tuesday includes an actively exploited Office zero-day vulnerability and several critical RCE bugs in Windows and Remote Desktop.

  2026-05-26 03:08 UTC
• VirusTotal - Home
  web:www.virustotal.com

  VirusTotal is a platform for scanning files and URLs for viruses, malware, and other threats using multiple antivirus engines.

  2026-05-26 03:08 UTC

Only Available for Registered Users. Sign in to view.