Payroll System CVE-2026-81202

The only prerequisite is that ajax.php is reachable over the network, which is the default deployment posture for a web-based payroll application. No authentication, no special application configuration, no specific platform version beyond Payroll System 1.0, and no user interaction is required - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero attacker prerequisites against a default-configured instance. Exploitation is limited to systems where ajax.php is network-accessible; instances deployed exclusively on an isolated intranet, behind a VPN, or with web server-level access controls blocking the endpoint are not directly exposed. Impact is bounded to the application's payroll database scope - lateral movement beyond the application is not implied by available data.

The CVSS 4.0 score of 6.9 encodes network accessibility (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), with partial impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L). The E:P exploit maturity modifier is the most operationally significant signal here: a working proof-of-concept is publicly available on GitHub, collapsing the skill barrier to near zero. No CISA KEV listing exists and no EPSS score was provided, but the combination of unauthenticated network access with a published exploit means this should be treated as actively exploitable in practice rather than theoretical. The individual impact metrics (all 'Low') may cause under-prioritization - but unauthorized access to payroll CRUD operations carries real compliance, legal, and operational risk disproportionate to the raw scores: salary data exposure, fraudulent record modification, and payroll disruption all have organizational consequences well beyond a 'Low' label. Any internet-facing instance should be treated as compromised-until-remediated.

An unauthenticated attacker sends a crafted HTTP POST request to the publicly accessible ajax.php endpoint with a manipulated 'action' parameter value targeting a CRUD operation - for example, listing all employee salary records or modifying a specific record. With the proof-of-concept code available at https://github.com/microwaveabi/vul/issues/7, exploitation requires only knowledge of the target URL and the parameter structure, with no credentials or prior access. The attacker can exfiltrate payroll data, insert fraudulent records, or delete existing entries in a single unauthenticated request.