by Kastro
Paper/Archive/CVE-2026-89308

CVE-2026-89308

TREXOM TrxTimeATTENDANCE — Arbitrary command execution in TrxTimeATTENDANCE

EPSS 2%CVSS 9.3
critical.is priorityof 100
44
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 81.5.815 × 2016.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary commands on the underlying operating system and achieve remote code execution.

Affected

ProductAffectedFixed inSource
TrxTimeATTENDANCE1.0.5 – < 1.9.61.9.6CNA

Scores by source

ENISA (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reftrexom.net/sviluppo-di-apprefacn.gov.it/portale/w/trexom-aggiornamenti-di-sicurezza