CVE-2026-78201
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability was found in itsourcecode Payroll System 1.0 in the Login function of admin_class.php. Manipulation of the Username argument leads to SQL injection. The attack can be performed remotely, and the exploit has been disclosed publicly.
Risk Assessment
SQL injection may allow an attacker to gain unauthorized access to the database, steal credentials, or modify system data.
Recommendation
Apply patches or use parameterized queries. Restrict access to the login functionality and monitor logs for suspicious activity.
Other vulnerabilities in itsourcecode Payroll System
See all- CVE-2026-81202High
A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used.
- CVE-2026-78202High
A vulnerability was found in itsourcecode Payroll System 1.0 in the save_settings function of admin_class.php. Manipulation of the img argument results in unrestricted upload. The attack can be performed remotely, and the exploit has been made public.
Original NVD description (English source)
A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.