EUVD-2026-18118Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS score of 4.3 is relatively low, multiple factors elevate real-world risk. The CVSS vector confirms unauthenticated remote attack (AV:N, PR:N, AC:L), meaning any remote user can attempt exploitation without credentials or special conditions. The presence of publicly available exploit code (POC:YES) combined with the low attack complexity significantly reduces barriers to exploitation. However, the requirement for user interaction (UI:R) and limited impact scope (I:L with no confidentiality or availability impact) constrain severity. The E:P (Exploit: Proof of Concept) and RC:R (Confidence: Reasonable) ratings in the CVSS vector align with public disclosure. For SSVC prioritization: exploitation is confirmed possible (POC exists), impact is limited to integrity through client-side script injection, and the attack is not automatable against diverse targets. This presents moderate priority for organizations running Payroll Management System, particularly if the application handles sensitive employee or financial data where XSS could facilitate account takeover or data theft through session hijacking. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL containing JavaScript in the 'page' parameter, such as /navbar.php?page=<script>alert('XSS')</script>, and tricks a user into clicking the link via phishing email or social engineering. When the victim visits the URL, the unvalidated 'page' parameter is reflected in the HTML response, causing the attacker's script to execute in the victim's browser within the application's security context. The attacker could steal session cookies, perform actions on behalf of the victim, or redirect the user to a credential harvesting site. Publicly available exploit code lowers the skill barrier, making this attack accessible to less sophisticated threat actors. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Reflected cross-site scripting (XSS) in itsourcecode Payroll Management System up to version 1.0 allows remote attackers to inject malicious scripts via the 'page' parameter in /navbar.php. The vulnerability requires user interaction (UI:R per CVSS vector) but carries a low CVSS score of 4.3 due to limited confidentiality impact. Publicly available exploit code exists, increasing real-world risk despite the moderate base score.
RemediationAI
Upgrade itsourcecode Payroll Management System to a patched version released after version 1.0 if available from the vendor. Primary mitigation involves applying input validation and output encoding to the 'page' parameter in /navbar.php to prevent script injection; specifically, use parameterized template methods or HTML entity encoding for all user-supplied input before inclusion in responses. Implement Content Security Policy (CSP) headers to restrict inline script execution and limit script sources. As an interim measure, apply a Web Application Firewall (WAF) rule to detect and block payloads containing script tags or JavaScript event handlers in the page parameter. Contact itsourcecode support at https://itsourcecode.com/ for patch availability and timeline, or refer to VulDB references at https://vuldb.com/vuln/354651 for additional technical details and community-contributed workarounds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a reflected cross-site scripting vulnerability (CWE-79) in a PHP-based payroll management application. The vulnerability exists in the /navbar.php file where user-supplied input from the 'page' parameter is not properly sanitized or encoded before being reflected in HTTP responses. The attack exploits the browser's trust in content served from the application domain, allowing attackers to execute arbitrary JavaScript in the context of a victim's session. The affected product is identified as itsourcecode Payroll Management System via CPE cpe:2.3:a:itsourcecode:payroll_management_system:*:*:*:*:*:*:*:*, indicating all versions up to and including 1.0 are vulnerable.
Know when Payroll Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in itsourcecode Payroll Management System up to 1.0. Affected is an unknown function of the file /navbar.php. Such manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Payroll Management System
View allSourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Rated critical severity (CVSS 9.8), this vul
Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. Rated
A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0.php?acti
A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Rated medium severity (C
Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter. Rat
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to read or modify database contents via
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject malicious SQL commands throug
SQL injection in Campcodes Payroll Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQ
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the
Unauthenticated SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate backend d
A weakness has been identified in Campcodes Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulner
SQL injection in code-projects Payroll Management System 1.0 via the ID parameter in /ajax.php?action=save_department al
Exploit-DB