CVE-2010-0122
Multiple SQL injection vulnerabilities in Employee Timeclock Software 0.99 allow remote attackers...
CVE-2010-0122 is a high vulnerability (CVSS 7.5) in Timeclock-software Employee Timeclock Software, published March 12, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.31%, the 83rd percentile. No source names a fixed version.
Multiple SQL injection vulnerabilities in Employee Timeclock Software 0.99 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to (a) auth.php or (b) login_action.php.
Exploit likelihood
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in Employee Timeclock Software 0.99 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to (a) auth.php or (b) login_action.php.
- Record
CVE-2010-0122- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Multiple SQL injection vulnerabilities in Employee Timeclock Software 0.99 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to (a) auth.php or (b) login_action.php.
- Record
CVE-2010-0122- Updated
- 2026-11-02
EUVDEUVD-2010-0154 No score
Multiple SQL injection vulnerabilities in Employee Timeclock Software 0.99 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to (a) auth.php or (b) login_action.php.
- Record
EUVD-2010-0154- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-855f-vpmx-8c43 No score
Multiple SQL injection vulnerabilities in Employee Timeclock Software 0.99 allow remote attackers...
Multiple SQL injection vulnerabilities in Employee Timeclock Software 0.99 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to (a) auth.php or (b) login_action.php.
- Record
GHSA-855f-vpmx-8c43- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Employee TimeClock Software 0.99 - SQL Injection | 2010-03-10 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD |