CVE-2021-47967

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths and POST parameters. Attackers can append malicious payloads to login.php, timeclock.php, audit.php, and timerpt.php endpoints, or inject code through from_date and to_date parameters in report requests to execute scripts in user browsers.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2021

CVE-2021-479686.4Podcast Generator 3.1 is vulnerable to persistent cross-site scripting, allowing authenticated attackers to inject malicious scripts by submCVE-2021-479697.5Color Notes 1.4 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long characCVE-2021-479707.5Macaron Notes 5.5 contains a denial of service vulnerability that allows attackers to crash the application by creating notes with excessiveCVE-2021-479717.5My Notes Safe 5.3 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long charCVE-2021-479727.5Sticky Notes & Color Widgets 1.4.2 contains a denial of service vulnerability that allows attackers to crash the application by creating notCVE-2021-479737.5Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively lCVE-2021-479747.8VX Search 13.5.28 contains an unquoted service path vulnerability in both VX Search Server and VX Search Enterprise services that allows locCVE-2021-479757.2WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scriptCVE-2021-479768.8TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files bCVE-2021-479777.5WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows unauthenticaCVE-2021-479786.2ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploitingCVE-2021-479798.8WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete fi
CVE-2021-47967: Medium severity, CVSS 6.1 | Vulnix