CVE-2024-39250

EfroTech Timetrax v8.3 contains an unauthenticated SQL injection vulnerability located in the q parameter of the search web interface. An unauthenticated attacker can exploit this flaw to execute SQL commands, potentially allowing them to extract or modify sensitive database information . While a...

CVE-2025-46157

EfroTech Time Trax v.1.0 is vulnerable to Remote Code Execution (RCE) and Privilege Escalation due to insecure server-side file validation in the Leave Request form of the Attendance module. An authenticated attacker can bypass upload restrictions by modifying a request to change a .txt file exte...