Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-124815

Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.

CVSS 3.1 · 10.0 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Clockinator Lite
CVE-2026-124817

Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Clockinator Lite