Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-12
Clockinator Lite - Security Vulnerability (CVE-2026-124815)
The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.
PLUGIN
Clockinator Lite
CVE-2026-124815
Risk Score
Threat Entry
Updated 2026-11-12
Clockinator Lite - Security Vulnerability (CVE-2026-124817)
The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.
PLUGIN
Clockinator Lite
CVE-2026-124817
Risk Score