CVE-2020-8496

In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator.

• CWE-79

• http://www.nolanbkennedy.com/post/stored-xss-2-in-kronos-web-time-and-attendance-webtaExploit, Third Party Advisory
• https://www.kronos.com/products/kronos-webtaProduct, Vendor Advisory
• http://www.nolanbkennedy.com/post/stored-xss-2-in-kronos-web-time-and-attendance-webtaExploit, Third Party Advisory
• https://www.kronos.com/products/kronos-webtaProduct, Vendor Advisory

Published

Jan 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8488Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8489Insufficient protection of the inter-process communication f…7.8
• CVE-2020-8492Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.…6.5
• CVE-2020-8493A stored XSS vulnerability in Kronos Web Time and Attendance…4.8
• CVE-2020-8494In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.…8.8
• CVE-2020-8495In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.…7.5
• CVE-2020-8497In Artica Pandora FMS through 7.42, an unauthenticated attac…5.3
• CVE-2020-8498XSS exists in the shortcode functionality of the GistPress p…5.4
• CVE-2020-8500In Artica Pandora FMS 7.42, Web Admin users can execute arbi…7.2
• CVE-2020-8503Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 …6.5
• CVE-2020-8504School Management Software PHP/mySQL through 2019-03-14 allo…6.5
• CVE-2020-8505School Management Software PHP/mySQL through 2019-03-14 allo…6.5