CVE-2026-89308

Summary

An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary commands on the underlying operating system and achieve remote code execution.

Affected Software

VendorProductVersion RangeStatus
TREXOMTrxTimeATTENDANCE1.0.5 < 1.9.6affected

Weaknesses

  • CWE-78: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Workarounds

Block all HTTP requests to the ping.php endpoint at the web server or firewall level.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References