CVE-2020-14982

PoC —

CVSS 3.1

6.5 medium

EPSS

1%p69

Published

Jul 15, 2020 (Jul 15, 2020)

Modified

Jun 17, 2026

Description

A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 (affecting the com.threeis.webta.H352premPayRequest servlet's SortBy parameter) allows an attacker with the Employee, Supervisor, or Timekeeper role to read sensitive data from the database.

Vendors: kronos
Products: web time and attendance
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news0 stories

No ingested article mentions this CVE yet.