CVE-2012-10047: Cyclope-Series Cyclope Employee Surveillance Solution

Critical severity, CVSS 10.0. EPSS: 1.3% chance of exploitation in the next 30 days.

Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a malicious PHP file on disk, resulting in remote code execution under the SYSTEM user context.

Affected products

• Cyclope-Series Cyclope Employee Surveillance Solution: version 6.0 only

Published 2025-08-08. Last modified 2026-06-16.