PHP Timeclock 1.04 allows an unauthenticated attacker to inject arbitrary JavaScript by appending malicious payloads to endpoints such as login.php, timeclock.php, audit.php, timerpt.php, or by manipulating the from_date and to_date parameters in report requests. The injected code runs in the user's browser, enabling session hijacking, cookie theft, defacement, or other client‑side attacks.

The vulnerability affects the Timeclock application titled PHP Timeclock, specifically version 1.04. No other product or version information is provided.

The CVSS score of 5.1 indicates a moderate severity while the EPSS score is not provided, and the vulnerability is not listed in CISA KEV. Attackers can exploit it remotely through standard HTTP requests, requiring no authentication. Though the impact is primarily client‑side, it can be leveraged to compromise user sessions and potentially accrue additional privilege within the web application.