Is there a public PoC exploit available for EUVD-2026-18118?

Yes, a public proof-of-concept exploit is available for EUVD-2026-18118. Prioritise patching immediately. EPSS: 0.0%.

PHP EUVD-2026-18118

Q: What is the CVSS score of EUVD-2026-18118?

EUVD-2026-18118 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5319 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-02 VulDB

PHP XSS Payroll Management System Itsourcecode

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 03:30 euvd

EUVD-2026-18118

Analysis Generated

Apr 02, 2026 - 03:30 vuln.today

CVE Published

Apr 02, 2026 - 02:45 nvd

MEDIUM 5.3

DescriptionCVE.org

A security vulnerability has been detected in itsourcecode Payroll Management System up to 1.0. Affected is an unknown function of the file /navbar.php. Such manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Reflected cross-site scripting (XSS) in itsourcecode Payroll Management System up to version 1.0 allows remote attackers to inject malicious scripts via the 'page' parameter in /navbar.php. The vulnerability requires user interaction (UI:R per CVSS vector) but carries a low CVSS score of 4.3 due to limited confidentiality impact. Publicly available exploit code exists, increasing real-world risk despite the moderate base score.

Technical ContextAI

This is a reflected cross-site scripting vulnerability (CWE-79) in a PHP-based payroll management application. The vulnerability exists in the /navbar.php file where user-supplied input from the 'page' parameter is not properly sanitized or encoded before being reflected in HTTP responses. The attack exploits the browser's trust in content served from the application domain, allowing attackers to execute arbitrary JavaScript in the context of a victim's session. The affected product is identified as itsourcecode Payroll Management System via CPE cpe:2.3:a:itsourcecode:payroll_management_system:*:*:*:*:*:*:*:*, indicating all versions up to and including 1.0 are vulnerable.

RemediationAI

Upgrade itsourcecode Payroll Management System to a patched version released after version 1.0 if available from the vendor. Primary mitigation involves applying input validation and output encoding to the 'page' parameter in /navbar.php to prevent script injection; specifically, use parameterized template methods or HTML entity encoding for all user-supplied input before inclusion in responses. Implement Content Security Policy (CSP) headers to restrict inline script execution and limit script sources. As an interim measure, apply a Web Application Firewall (WAF) rule to detect and block payloads containing script tags or JavaScript event handlers in the page parameter. Contact itsourcecode support at https://itsourcecode.com/ for patch availability and timeline, or refer to VulDB references at https://vuldb.com/vuln/354651 for additional technical details and community-contributed workarounds.