CVE-2026-81202
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used.
Risk Assessment
An attacker could gain unauthorized access to CRUD functions, potentially leading to data modification or theft.
Recommendation
Apply vendor patches or restrict access to ajax.php.
Other vulnerabilities in itsourcecode Payroll System
See all- CVE-2026-78202High
A vulnerability was found in itsourcecode Payroll System 1.0 in the save_settings function of admin_class.php. Manipulation of the img argument results in unrestricted upload. The attack can be performed remotely, and the exploit has been made public.
- CVE-2026-78201High
A vulnerability was found in itsourcecode Payroll System 1.0 in the Login function of admin_class.php. Manipulation of the Username argument leads to SQL injection. The attack can be performed remotely, and the exploit has been disclosed publicly.
Original NVD description (English source)
A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used.