{"cve":"CVE-2025-9977","nvd":{"published":"2025-11-18T16:15:47.027","modified":"2026-10-18T20:10:00.110","status":"Deferred","description":"Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthenticated attacker to perform DoS attacks. SQL injection attacks might also be feasible, although so far creating a working exploit has been prevented probably by backend filtering mechanisms.\nAdditionally, command injection attempts cause the application to return extensive error messages disclosing some information about the internal infrastructure. \nPatching status is unknown because the vendor has not replied to messages sent by the CNA.","cvss_v4":{"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","score":5.3},"cvss_v3":null,"cwes":["CWE-89","CWE-209"],"references":["https://cert.pl/en/posts/2025/11/CVE-2025-9977","https://www.timesoftsg.com.sg/payroll-software/"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:16:02.354564667+00:00"},"epss":{"cve":"CVE-2025-9977","score":0.01893,"percentile":0.7945,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}