CVE-2020-37005: Timeclock Software

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

TimeClock Software 1.01 contains an authenticated time-based SQL injection vulnerability that allows attackers to enumerate valid usernames by manipulating the 'notes' parameter. Attackers can inject conditional time delays in the add_entry.php endpoint to determine user existence by measuring response time differences.

Affected products

• Timeclock Software Timeclock Software: version 1.01 only

Published 2026-01-29. Last modified 2026-06-17.