PatchTheCVE: iwcnetworkhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2017-17995: Biometric Shift Employee Management System has XSS via the Last_Name parameter in an index.php?user=ajax requehttps://patchthecve.com/cve/CVE-2017-17995.htmlhttps://patchthecve.com/cve/CVE-2017-17995.htmlWed, 17 Jun 2026 01:12:00 +0000MEDIUM 5.4: Biometric Shift Employee Management System has XSS via the Last_Name parameter in an index.php?user=ajax request.CVE-2017-17994: Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competency_https://patchthecve.com/cve/CVE-2017-17994.htmlhttps://patchthecve.com/cve/CVE-2017-17994.htmlWed, 17 Jun 2026 01:12:00 +0000MEDIUM 5.4: Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competency_criteria request.CVE-2017-17993: Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=addition_deduhttps://patchthecve.com/cve/CVE-2017-17993.htmlhttps://patchthecve.com/cve/CVE-2017-17993.htmlWed, 17 Jun 2026 01:12:00 +0000MEDIUM 5.4: Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=addition_deduction request.CVE-2017-17992: Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences inhttps://patchthecve.com/cve/CVE-2017-17992.htmlhttps://patchthecve.com/cve/CVE-2017-17992.htmlWed, 17 Jun 2026 01:12:00 +0000CRITICAL 9.8: Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php form_file_name parameter in a download_form action.CVE-2017-17991: Biometric Shift Employee Management System has XSS via the expense_name parameter in an index.php?user=expensehttps://patchthecve.com/cve/CVE-2017-17991.htmlhttps://patchthecve.com/cve/CVE-2017-17991.htmlWed, 17 Jun 2026 01:12:00 +0000MEDIUM 5.4: Biometric Shift Employee Management System has XSS via the expense_name parameter in an index.php?user=expenses request.CVE-2017-17990: Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action.https://patchthecve.com/cve/CVE-2017-17990.htmlhttps://patchthecve.com/cve/CVE-2017-17990.htmlWed, 17 Jun 2026 01:12:00 +0000HIGH 8.8: Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action.CVE-2017-17989: Biometric Shift Employee Management System has XSS via the index.php holiday_name parameter in an edit_holidayhttps://patchthecve.com/cve/CVE-2017-17989.htmlhttps://patchthecve.com/cve/CVE-2017-17989.htmlWed, 17 Jun 2026 01:12:00 +0000MEDIUM 5.4: Biometric Shift Employee Management System has XSS via the index.php holiday_name parameter in an edit_holiday action.CVE-2017-17876: Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictiohttps://patchthecve.com/cve/CVE-2017-17876.htmlhttps://patchthecve.com/cve/CVE-2017-17876.htmlWed, 17 Jun 2026 01:11:49 +0000HIGH 7.5: Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter.