CVE-2020-8493

A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, Banner Message, and Password Instructions) of the com.threeis.webta.H261configMenu servlet via an authenticated administrator.

• CWE-79

• http://packetstormsecurity.com/files/156215/Kronos-WebTA-4.0-Privilege-Escalation-Cross-Site-Scripting.htmlExploit, Third Party Advisory
• http://www.nolanbkennedy.com/post/stored-xss-in-kronos-web-time-and-attendance-webtaExploit, Third Party Advisory
• https://www.kronos.com/products/kronos-webtaProduct, Vendor Advisory
• http://packetstormsecurity.com/files/156215/Kronos-WebTA-4.0-Privilege-Escalation-Cross-Site-Scripting.htmlExploit, Third Party Advisory
• http://www.nolanbkennedy.com/post/stored-xss-in-kronos-web-time-and-attendance-webtaExploit, Third Party Advisory
• https://www.kronos.com/products/kronos-webtaProduct, Vendor Advisory

Published

Jan 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8485Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8486Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8487Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8488Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8489Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8492Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.…6.5
• CVE-2020-8494In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.…8.8
• CVE-2020-8495In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.…7.5
• CVE-2020-8496In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.…4.8
• CVE-2020-8497In Artica Pandora FMS through 7.42, an unauthenticated attac…5.3
• CVE-2020-8498XSS exists in the shortcode functionality of the GistPress p…5.4
• CVE-2020-8500In Artica Pandora FMS 7.42, Web Admin users can execute arbi…7.2