Which versions of PHP are affected by EUVD-2026-16195?

Organizations using itsourcecode Payroll Management System should be aware of moderate risk from CVE-2026-4877, a cross-site scripting vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for EUVD-2026-16195?

Yes, a public proof-of-concept exploit is available for EUVD-2026-16195. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-16195?

Within 30 days: Identify affected systems running itsourcecode Payroll Management System and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP EUVD-2026-16195

Q: What is the CVSS score of EUVD-2026-16195?

EUVD-2026-16195 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4877 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 VulDB

PHP XSS Payroll Management System Itsourcecode

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 13:45 euvd

EUVD-2026-16195

Analysis Generated

Mar 26, 2026 - 13:45 vuln.today

CVE Published

Mar 26, 2026 - 13:05 nvd

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in itsourcecode Payroll Management System up to 1.0. This affects an unknown function of the file /index.php. Performing a manipulation of the argument page results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Reflected cross-site scripting (XSS) in itsourcecode Payroll Management System version 1.0 allows remote unauthenticated attackers to inject malicious scripts via manipulation of the 'page' parameter in /index.php. The vulnerability has a CVSS v4.0 score of 5.3 with network accessibility and low integrity impact; publicly available exploit code exists, and CISA SSVC assessment confirms the flaw is exploitable and partially automatable, making it suitable for active compromise of application integrity and user sessions.

Technical ContextAI

The vulnerability is a reflected cross-site scripting (CWE-79) flaw in a PHP-based web application. The root cause is insufficient input validation and output encoding on the 'page' parameter within /index.php. The itsourcecode Payroll Management System (CPE:cpe:2.3:a:itsourcecode:payroll_management_system) processes user-supplied input without proper sanitization, allowing attackers to inject arbitrary HTML and JavaScript that executes in the victim's browser context. PHP applications are particularly susceptible to XSS when query parameters are reflected directly into HTML without encoding functions such as htmlspecialchars() or htmlentities().

RemediationAI

Upgrade itsourcecode Payroll Management System to the latest patched version released by the vendor; patch availability and specific version numbers should be confirmed via https://itsourcecode.com/ and https://nvd.nist.gov/vuln/detail/CVE-2026-4877. Until patching is completed, implement immediate compensating controls: enforce strict input validation on the 'page' parameter by using a whitelist of allowed values, apply output encoding using htmlspecialchars() or equivalent on all reflected parameters before rendering in HTML context, and deploy a Web Application Firewall (WAF) configured to detect and block reflected XSS payloads. Additionally, restrict application access to trusted internal networks only, implement Content Security Policy (CSP) headers to prevent inline script execution, and enable HTTP-only and Secure flags on session cookies to mitigate session hijacking.