CVE-2026-78202
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability was found in itsourcecode Payroll System 1.0 in the save_settings function of admin_class.php. Manipulation of the img argument results in unrestricted upload. The attack can be performed remotely, and the exploit has been made public.
Risk Assessment
Unrestricted file upload may allow an attacker to upload malicious files to the server, potentially leading to system compromise or arbitrary code execution.
Recommendation
Apply patches or restrict access to the file upload functionality. Implement file type validation and size limits.
Other vulnerabilities in itsourcecode Payroll System
See all- CVE-2026-81202High
A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used.
- CVE-2026-78201High
A vulnerability was found in itsourcecode Payroll System 1.0 in the Login function of admin_class.php. Manipulation of the Username argument leads to SQL injection. The attack can be performed remotely, and the exploit has been disclosed publicly.
Original NVD description (English source)
A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.