flaw exists in the ping.php endpoint of TrxTimeATTENDANCE, allowing an attacker to run arbitrary commands on the host operating system. This results in full remote code execution, giving the attacker complete control over the affected system and any data or services it hosts.

The vulnerability affects TREXOM’s TrxTimeATTENDANCE software, all releases prior to version 1.9.6.

The CVSS score of 9.3 indicates a critical severity. Because the attack requires no authentication and is delivered via an HTTP request to the publicly accessible ping.php endpoint, the likelihood of exploitation is high. The EPSS score of 3% confirms a non-negligible but moderate probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. This combination of unauthenticated remote exploitation, high severity, and measurable exploitation probability warrants immediate attention.