Online Payroll System EUVD-2026-110580

Exploitation targets the ID argument of the chat.php script and produces reflected cross-site scripting. Per the CVSS 4.0 vector, it requires an authenticated low-privileged account (PR:L) and victim user interaction (UI:P) - typically the victim opening an attacker-crafted link - so it is not a default, unauthenticated, zero-interaction scenario. Impact is limited to integrity on the vulnerable system (VI:L) with no confidentiality or availability effect. Realistic risk is further constrained by the product's niche, non-enterprise footprint and by the absence of any released fix, since the project uses a rolling release and has not responded to the report. The precise injection/trigger mechanics beyond the ID parameter are not described in the available sources.

This is a low-severity reflected cross-site scripting issue (CWE-79) in the chat.php component of an obscure GitHub-hosted payroll application, and nearly every available signal points to low real-world priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) scores only 2.0: network-reachable and low-complexity, but requiring an authenticated low-privileged account (PR:L) and victim interaction (UI:P), with impact limited to integrity-low on the vulnerable system and no confidentiality or availability effect. EPSS reinforces this at 0.20% (10th percentile), indicating very low predicted exploitation likelihood. The CVE is not listed in CISA KEV, so there is no confirmed active exploitation, and the vuln.today decision label is 'monitor' rather than any act-now tier. The exploit signal is weak: the input shows only a PoC reference (a GitHub issue), not verified working exploit code, so POC availability should not be conflated with active exploitation. All signals are consistent here - low CVSS, low EPSS, no KEV, monitor decision - so this is a genuinely low-priority finding rather than a high-CVSS/low-real-risk mismatch. The main open gap is that the product uses a rolling release with no affected or fixed version identifiers, and the vendor has not responded to the issue report, so there is no vendor-confirmed remediation.

An authenticated low-privileged user of the payroll system crafts a malicious value for the ID argument of chat.php and lures another logged-in user into opening the resulting link, causing attacker-controlled script to execute in the victim's browser session. A public PoC reference exists (a GitHub issue) but is not verified as working exploit code, so practical weaponization is unconfirmed. The low-complexity network vector is offset by the required authentication and victim interaction.