CVE-2021-47966CWE-89

PHP Timeclock 1.04 SQL Injection via login.php

High · published May 15, 2026

CVSS v4.0

8.8

EPSS

Percentile

18.3

In the wild

Unconfirmed

What it is

PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid parameter of login.php that allows unauthenticated attackers to extract database contents. Attackers can submit crafted POST requests with SQL payloads using SLEEP functions or RLIKE conditional statements to dump sensitive database information including employee names and credentials.

The record

Technical detail

CVSS v4.0: 8.8 · HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00270 · 18.3th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-05-15T18:36Z

EPSS history

Timeline

15 MAY 18:36Z
PHP Timeclock 1.04 SQL Injection via login.php
cvelistv5