{"id":"CVE-2024-55971","aliases":["EUVD-2024-52871","GHSA-2848-r5h7-h9rj"],"status":"published","title":"SQL Injection vulnerability in the default configuration of the Logitime WebClock application \u003c=...","description":"SQL Injection vulnerability in the default configuration of the Logitime WebClock application \u003c= 5.43.0 allows an unauthenticated user to run arbitrary code on the backend database server.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00675,"percentile":0.52537,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2025-01-23T00:00:00Z","modified":"2026-06-17T08:11:31Z","references":[{"url":"https://nl.logitime.com/"},{"url":"https://en.logitime.com/time-attendance/"},{"url":"https://tulling.dev/disclosures/cve-2024-55971/"},{"url":"https://nl.logitime.com/download/webclock-v5-43-0-13-12-2024/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55971"},{"url":"https://en.logitime.com/time-attendance"},{"url":"https://nl.logitime.com"},{"url":"https://nl.logitime.com/download/webclock-v5-43-0-13-12-2024"},{"url":"https://tulling.dev/disclosures/cve-2024-55971"},{"url":"https://github.com/advisories/GHSA-2848-r5h7-h9rj"}],"sources":{"cve":[{"id":"CVE-2024-55971","description":"SQL Injection vulnerability in the default configuration of the Logitime WebClock application \u003c= 5.43.0 allows an unauthenticated user to run arbitrary code on the backend database server.","status":"published","published":"2025-01-23T00:00:00Z","modified":"2025-02-06T21:27:28.806Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:22.153872Z"}],"euvd":[{"id":"EUVD-2024-52871","description":"SQL Injection vulnerability in the default configuration of the Logitime WebClock application \u003c= 5.43.0 allows an unauthenticated user to run arbitrary code on the backend database server.","status":"published","published":"2025-01-23T00:00:00Z","modified":"2025-02-06T21:27:28Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:02.347135Z"}],"ghsa":[{"id":"GHSA-2848-r5h7-h9rj","title":"SQL Injection vulnerability in the default configuration of the Logitime WebClock application \u003c=...","description":"SQL Injection vulnerability in the default configuration of the Logitime WebClock application \u003c= 5.43.0 allows an unauthenticated user to run arbitrary code on the backend database server.","status":"published","published":"2025-01-23T18:31:19Z","modified":"2025-02-07T03:33:05Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:59:49.949775Z"}],"nvd":[{"id":"CVE-2024-55971","description":"SQL Injection vulnerability in the default configuration of the Logitime WebClock application \u003c= 5.43.0 allows an unauthenticated user to run arbitrary code on the backend database server.","status":"published","published":"2025-01-23T16:15:36.307Z","modified":"2026-06-17T08:11:31.203Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:10:42.895329Z"}]}}