Payroll Management System
Monthly
Reflected cross-site scripting (XSS) in itsourcecode Payroll Management System up to version 1.0 allows remote attackers to inject malicious scripts via the 'page' parameter in /navbar.php. The vulnerability requires user interaction (UI:R per CVSS vector) but carries a low CVSS score of 4.3 due to limited confidentiality impact. Publicly available exploit code exists, increasing real-world risk despite the moderate base score.
Reflected cross-site scripting (XSS) in itsourcecode Payroll Management System version 1.0 allows remote unauthenticated attackers to inject malicious scripts via manipulation of the 'page' parameter in /index.php. The vulnerability has a CVSS v4.0 score of 5.3 with network accessibility and low integrity impact; publicly available exploit code exists, and CISA SSVC assessment confirms the flaw is exploitable and partially automatable, making it suitable for active compromise of application integrity and user sessions.
SQL injection in itsourcecode Payroll Management System 1.0 via the ID parameter in /manage_employee.php allows unauthenticated remote attackers to execute arbitrary SQL queries and access or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available. Organizations running this system should implement network-level protections and consider upgrading to a patched version once released.
Stored cross-site scripting in itsourcecode Payroll Management System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the ID parameter in /manage_employee_allowances.php. Public exploit code exists for this vulnerability, though no patch is currently available. Successful exploitation could enable credential theft or unauthorized actions within the payroll system.
A weakness has been identified in Campcodes Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate the 'ID' parameter via /ajax.php?action=save_deductions, enabling arbitrary database queries and potential data leakage or modification. The vulnerability is publicly known with exploit code available, though no active exploitation has been confirmed via CISA KEV. EPSS indicates low exploitation probability (0.05%).
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /ajax.php?action=delete_allowances. Public exploit code is available, but EPSS exploitation probability is low (0.05%) and no active exploitation (CISA KEV) is identified.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject SQL via the ID parameter in /ajax.php?action=delete_position. A publicly available exploit exists, and the vulnerability can be triggered with no authentication. The impact is limited to low-confidentiality, low-integrity, and low-availability effects per the assessed CVSS.
We need to produce a JSON with all specified fields. The input: CVE-2025-7217, description, etc. We'll synthesize from multiple sources. Note: CVSS provided is only CVSS 4.0 vector. No KEV status (so no KEV, it's not in KEV list). EPSS 0.05% (low), POC publicly available. Tags: SQLi, PHP, Payroll Management System. Product: Campcodes Payroll Management System 1.0. File: /ajax.php?action=save_position, parameter ID -> SQL injection. Classification: critical. Exploit disclosed. References: GitHub issue (exploit), VulDB entries, etc. Need fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. Let's go field by field: 1. product_name: "Payroll Management System" (1-3 words). Product is "Payroll Management System" by Campcodes. But to be precise: "Campcodes Payroll Management System" is 4 words. Could be "Payroll Management System"? Usually referred as "Campcodes Payroll Management System" but we can use just "Payroll Management System" with vendor in context. But requirement: "3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." So "Campcodes Payroll Management System" is 3 words: Campcodes, Payroll, Management, System = 4 words. "Payroll Management System" is 3 words. It's acceptable, but it might be too generic. Maybe "Campcodes Payroll System"? That's 3. However, the CPE is "campcodes:payroll_management_system". I'll output "Campcodes Payroll Management System" as 4 words? No, I'll try "Payroll Management System" – but there's a risk it's not specific. But the guideline says "product or service name", and examples like "WordPress" not "WordPres
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to read or modify database contents via the ID parameter in /ajax.php?action=save_payroll. The vulnerability is rated critical and has publicly available exploit code, though no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.06%), suggesting low probability of widespread exploitation.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject malicious SQL commands through the employee_id parameter when saving attendance records via /ajax.php?action=save_employee_attendance. Exploit code is publicly available, though EPSS exploitation probability is very low (0.06%). The vulnerability can lead to unauthorized modification of employee data and potential disclosure of database contents.
SQL injection in Campcodes Payroll Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the delete_payroll Ajax endpoint. Public exploit code is available, though EPSS probability is low (0.06%) and no active exploitation in CISA KEV has been reported.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /ajax.php?action=delete_employee_attendance_single endpoint, potentially leading to data exposure or modification. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
We need to produce a JSON with all the specified fields. Let's synthesize the data. First, extract relevant info: - CVE ID: CVE-2025-7128 - Product: Campcodes Payroll Management System 1.0 (from description, CPE, tags). The product_name field should be "Payroll Management System" (1-3 words). Could be "Campcodes Payroll Management System" if that's the product name? But the description says "Campcodes Payroll Management System 1.0". The product is the Payroll Management System by Campcodes. I'll use "Payroll Management System" as the primary product name, but note it's from Campcodes. I'd go with "Payroll Management System" — 3 words. - summary: Must be original synthesis. It's SQL injection in the file /ajax.php?action=calculate_payroll via the ID parameter. Remote attack. Exploit disclosed. CVSS 4.0 vector given, but only base score 5.5 with N impacts all low. EPSS 0.06%, very low. POC available but not KEV. No active exploitation known. So summary: "SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /ajax.php?action=calculate_payroll. Exploit code is publicly available, though no active exploitation has been confirmed. Successful exploitation could lead to data leakage or modification." - technical_context: CWE-74 is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", but SQL injection is a more specific CWE-89. However NVD assigned CWE-74. Underlying technology: PHP web application, using SQL database. CPE confirms exact product version. So explain that the vulnerability arises from improper input validation in the Payroll Management System's AJAX endpoint, leading to SQL injection. - risk_assessment: Use CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So network vector, low complexity, no privileges, no user interaction, low impact on confidentiality, integrity, availability (all L). No subseq
SQL injection in code-projects Payroll Management System 1.0 via the ID parameter in /ajax.php?action=save_department allows remote attackers to execute arbitrary SQL commands, potentially compromising backend database content. A public proof-of-concept exploit is available, but no active exploitation has been confirmed (EPSS 0.06%).
A vulnerability classified as critical has been found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in SourceCodester Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0.php?action=delete_deductions. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in itsourcecode Payroll Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reflected cross-site scripting (XSS) in itsourcecode Payroll Management System up to version 1.0 allows remote attackers to inject malicious scripts via the 'page' parameter in /navbar.php. The vulnerability requires user interaction (UI:R per CVSS vector) but carries a low CVSS score of 4.3 due to limited confidentiality impact. Publicly available exploit code exists, increasing real-world risk despite the moderate base score.
Reflected cross-site scripting (XSS) in itsourcecode Payroll Management System version 1.0 allows remote unauthenticated attackers to inject malicious scripts via manipulation of the 'page' parameter in /index.php. The vulnerability has a CVSS v4.0 score of 5.3 with network accessibility and low integrity impact; publicly available exploit code exists, and CISA SSVC assessment confirms the flaw is exploitable and partially automatable, making it suitable for active compromise of application integrity and user sessions.
SQL injection in itsourcecode Payroll Management System 1.0 via the ID parameter in /manage_employee.php allows unauthenticated remote attackers to execute arbitrary SQL queries and access or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available. Organizations running this system should implement network-level protections and consider upgrading to a patched version once released.
Stored cross-site scripting in itsourcecode Payroll Management System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the ID parameter in /manage_employee_allowances.php. Public exploit code exists for this vulnerability, though no patch is currently available. Successful exploitation could enable credential theft or unauthorized actions within the payroll system.
A weakness has been identified in Campcodes Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate the 'ID' parameter via /ajax.php?action=save_deductions, enabling arbitrary database queries and potential data leakage or modification. The vulnerability is publicly known with exploit code available, though no active exploitation has been confirmed via CISA KEV. EPSS indicates low exploitation probability (0.05%).
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /ajax.php?action=delete_allowances. Public exploit code is available, but EPSS exploitation probability is low (0.05%) and no active exploitation (CISA KEV) is identified.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject SQL via the ID parameter in /ajax.php?action=delete_position. A publicly available exploit exists, and the vulnerability can be triggered with no authentication. The impact is limited to low-confidentiality, low-integrity, and low-availability effects per the assessed CVSS.
We need to produce a JSON with all specified fields. The input: CVE-2025-7217, description, etc. We'll synthesize from multiple sources. Note: CVSS provided is only CVSS 4.0 vector. No KEV status (so no KEV, it's not in KEV list). EPSS 0.05% (low), POC publicly available. Tags: SQLi, PHP, Payroll Management System. Product: Campcodes Payroll Management System 1.0. File: /ajax.php?action=save_position, parameter ID -> SQL injection. Classification: critical. Exploit disclosed. References: GitHub issue (exploit), VulDB entries, etc. Need fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. Let's go field by field: 1. product_name: "Payroll Management System" (1-3 words). Product is "Payroll Management System" by Campcodes. But to be precise: "Campcodes Payroll Management System" is 4 words. Could be "Payroll Management System"? Usually referred as "Campcodes Payroll Management System" but we can use just "Payroll Management System" with vendor in context. But requirement: "3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." So "Campcodes Payroll Management System" is 3 words: Campcodes, Payroll, Management, System = 4 words. "Payroll Management System" is 3 words. It's acceptable, but it might be too generic. Maybe "Campcodes Payroll System"? That's 3. However, the CPE is "campcodes:payroll_management_system". I'll output "Campcodes Payroll Management System" as 4 words? No, I'll try "Payroll Management System" – but there's a risk it's not specific. But the guideline says "product or service name", and examples like "WordPress" not "WordPres
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to read or modify database contents via the ID parameter in /ajax.php?action=save_payroll. The vulnerability is rated critical and has publicly available exploit code, though no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.06%), suggesting low probability of widespread exploitation.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject malicious SQL commands through the employee_id parameter when saving attendance records via /ajax.php?action=save_employee_attendance. Exploit code is publicly available, though EPSS exploitation probability is very low (0.06%). The vulnerability can lead to unauthorized modification of employee data and potential disclosure of database contents.
SQL injection in Campcodes Payroll Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the delete_payroll Ajax endpoint. Public exploit code is available, though EPSS probability is low (0.06%) and no active exploitation in CISA KEV has been reported.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /ajax.php?action=delete_employee_attendance_single endpoint, potentially leading to data exposure or modification. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
We need to produce a JSON with all the specified fields. Let's synthesize the data. First, extract relevant info: - CVE ID: CVE-2025-7128 - Product: Campcodes Payroll Management System 1.0 (from description, CPE, tags). The product_name field should be "Payroll Management System" (1-3 words). Could be "Campcodes Payroll Management System" if that's the product name? But the description says "Campcodes Payroll Management System 1.0". The product is the Payroll Management System by Campcodes. I'll use "Payroll Management System" as the primary product name, but note it's from Campcodes. I'd go with "Payroll Management System" — 3 words. - summary: Must be original synthesis. It's SQL injection in the file /ajax.php?action=calculate_payroll via the ID parameter. Remote attack. Exploit disclosed. CVSS 4.0 vector given, but only base score 5.5 with N impacts all low. EPSS 0.06%, very low. POC available but not KEV. No active exploitation known. So summary: "SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /ajax.php?action=calculate_payroll. Exploit code is publicly available, though no active exploitation has been confirmed. Successful exploitation could lead to data leakage or modification." - technical_context: CWE-74 is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", but SQL injection is a more specific CWE-89. However NVD assigned CWE-74. Underlying technology: PHP web application, using SQL database. CPE confirms exact product version. So explain that the vulnerability arises from improper input validation in the Payroll Management System's AJAX endpoint, leading to SQL injection. - risk_assessment: Use CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So network vector, low complexity, no privileges, no user interaction, low impact on confidentiality, integrity, availability (all L). No subseq
SQL injection in code-projects Payroll Management System 1.0 via the ID parameter in /ajax.php?action=save_department allows remote attackers to execute arbitrary SQL commands, potentially compromising backend database content. A public proof-of-concept exploit is available, but no active exploitation has been confirmed (EPSS 0.06%).
A vulnerability classified as critical has been found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in SourceCodester Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0.php?action=delete_deductions. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in itsourcecode Payroll Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.