What’s Vulnerable › Vulnerabilities

CVE-2026-89308: Arbitrary command execution in TrxTimeATTENDANCE

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-15 · updated 2026-09-18
• Weakness: CWE-78

Description

An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary commands on the underlying operating system and achieve remote code execution.

Affected products

• TREXOM TrxTimeATTENDANCE: from 1.0.5 before 1.9.6 — fixed in 1.9.6

How to fix

Upgrade to a fixed version: TREXOM TrxTimeATTENDANCE 1.9.6. Check the vendor advisory for mitigations.

References

• https://www.acn.gov.it/portale/w/trexom-aggiornamenti-di-sicurezza
• https://www.trexom.net/sviluppo-di-app/

Get alerted when CVE-2026-89308 or the next vulnerability affects your stack