Payroll Management System
Monthly
Reflected cross-site scripting (XSS) in itsourcecode Payroll Management System up to version 1.0 allows remote attackers to inject malicious scripts via the 'page' parameter in /navbar.php. The vulnerability requires user interaction (UI:R per CVSS vector) but carries a low CVSS score of 4.3 due to limited confidentiality impact. Publicly available exploit code exists, increasing real-world risk despite the moderate base score.
Reflected cross-site scripting (XSS) in itsourcecode Payroll Management System version 1.0 allows remote unauthenticated attackers to inject malicious scripts via manipulation of the 'page' parameter in /index.php. The vulnerability has a CVSS v4.0 score of 5.3 with network accessibility and low integrity impact; publicly available exploit code exists, and CISA SSVC assessment confirms the flaw is exploitable and partially automatable, making it suitable for active compromise of application integrity and user sessions.
SQL injection in itsourcecode Payroll Management System 1.0 via the ID parameter in /manage_employee.php allows unauthenticated remote attackers to execute arbitrary SQL queries and access or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available. Organizations running this system should implement network-level protections and consider upgrading to a patched version once released.
Stored cross-site scripting in itsourcecode Payroll Management System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the ID parameter in /manage_employee_allowances.php. Public exploit code exists for this vulnerability, though no patch is currently available. Successful exploitation could enable credential theft or unauthorized actions within the payroll system.
A weakness has been identified in Campcodes Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate the 'ID' parameter via /ajax.php?action=save_deductions, enabling arbitrary database queries and potential data leakage or modification. The vulnerability is publicly known with exploit code available, though no active exploitation has been confirmed via CISA KEV. EPSS indicates low exploitation probability (0.05%).
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /ajax.php?action=delete_allowances. Public exploit code is available, but EPSS exploitation probability is low (0.05%) and no active exploitation (CISA KEV) is identified.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject SQL via the ID parameter in /ajax.php?action=delete_position. A publicly available exploit exists, and the vulnerability can be triggered with no authentication. The impact is limited to low-confidentiality, low-integrity, and low-availability effects per the assessed CVSS.
SQL injection in Campcodes Payroll Management System 1.0 exposes the application's database through the `/ajax.php?action=save_position` endpoint, where unsanitized input to the `ID` parameter is passed directly to backend SQL queries. Unauthenticated remote attackers can read, modify, or delete database records. A public proof-of-concept exploit has been disclosed via GitHub, though EPSS probability remains very low at 0.05% (14th percentile), consistent with the niche footprint of the product.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to read or modify database contents via the ID parameter in /ajax.php?action=save_payroll. The vulnerability is rated critical and has publicly available exploit code, though no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.06%), suggesting low probability of widespread exploitation.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject malicious SQL commands through the employee_id parameter when saving attendance records via /ajax.php?action=save_employee_attendance. Exploit code is publicly available, though EPSS exploitation probability is very low (0.06%). The vulnerability can lead to unauthorized modification of employee data and potential disclosure of database contents.
SQL injection in Campcodes Payroll Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the delete_payroll Ajax endpoint. Public exploit code is available, though EPSS probability is low (0.06%) and no active exploitation in CISA KEV has been reported.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /ajax.php?action=delete_employee_attendance_single endpoint, potentially leading to data exposure or modification. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
Unauthenticated SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate backend database queries by supplying crafted input to the `ID` parameter of `/ajax.php?action=calculate_payroll`. The vulnerability stems from unsanitized user-controlled input being embedded directly into SQL statements, enabling data extraction or modification. A public proof-of-concept exploit has been disclosed via GitHub, though no active exploitation has been confirmed in CISA KEV.
SQL injection in code-projects Payroll Management System 1.0 via the ID parameter in /ajax.php?action=save_department allows remote attackers to execute arbitrary SQL commands, potentially compromising backend database content. A public proof-of-concept exploit is available, but no active exploitation has been confirmed (EPSS 0.06%).
A vulnerability classified as critical has been found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in SourceCodester Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0.php?action=delete_deductions. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in itsourcecode Payroll Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reflected cross-site scripting (XSS) in itsourcecode Payroll Management System up to version 1.0 allows remote attackers to inject malicious scripts via the 'page' parameter in /navbar.php. The vulnerability requires user interaction (UI:R per CVSS vector) but carries a low CVSS score of 4.3 due to limited confidentiality impact. Publicly available exploit code exists, increasing real-world risk despite the moderate base score.
Reflected cross-site scripting (XSS) in itsourcecode Payroll Management System version 1.0 allows remote unauthenticated attackers to inject malicious scripts via manipulation of the 'page' parameter in /index.php. The vulnerability has a CVSS v4.0 score of 5.3 with network accessibility and low integrity impact; publicly available exploit code exists, and CISA SSVC assessment confirms the flaw is exploitable and partially automatable, making it suitable for active compromise of application integrity and user sessions.
SQL injection in itsourcecode Payroll Management System 1.0 via the ID parameter in /manage_employee.php allows unauthenticated remote attackers to execute arbitrary SQL queries and access or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available. Organizations running this system should implement network-level protections and consider upgrading to a patched version once released.
Stored cross-site scripting in itsourcecode Payroll Management System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the ID parameter in /manage_employee_allowances.php. Public exploit code exists for this vulnerability, though no patch is currently available. Successful exploitation could enable credential theft or unauthorized actions within the payroll system.
A weakness has been identified in Campcodes Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate the 'ID' parameter via /ajax.php?action=save_deductions, enabling arbitrary database queries and potential data leakage or modification. The vulnerability is publicly known with exploit code available, though no active exploitation has been confirmed via CISA KEV. EPSS indicates low exploitation probability (0.05%).
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /ajax.php?action=delete_allowances. Public exploit code is available, but EPSS exploitation probability is low (0.05%) and no active exploitation (CISA KEV) is identified.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject SQL via the ID parameter in /ajax.php?action=delete_position. A publicly available exploit exists, and the vulnerability can be triggered with no authentication. The impact is limited to low-confidentiality, low-integrity, and low-availability effects per the assessed CVSS.
SQL injection in Campcodes Payroll Management System 1.0 exposes the application's database through the `/ajax.php?action=save_position` endpoint, where unsanitized input to the `ID` parameter is passed directly to backend SQL queries. Unauthenticated remote attackers can read, modify, or delete database records. A public proof-of-concept exploit has been disclosed via GitHub, though EPSS probability remains very low at 0.05% (14th percentile), consistent with the niche footprint of the product.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to read or modify database contents via the ID parameter in /ajax.php?action=save_payroll. The vulnerability is rated critical and has publicly available exploit code, though no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.06%), suggesting low probability of widespread exploitation.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject malicious SQL commands through the employee_id parameter when saving attendance records via /ajax.php?action=save_employee_attendance. Exploit code is publicly available, though EPSS exploitation probability is very low (0.06%). The vulnerability can lead to unauthorized modification of employee data and potential disclosure of database contents.
SQL injection in Campcodes Payroll Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the delete_payroll Ajax endpoint. Public exploit code is available, though EPSS probability is low (0.06%) and no active exploitation in CISA KEV has been reported.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /ajax.php?action=delete_employee_attendance_single endpoint, potentially leading to data exposure or modification. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
Unauthenticated SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate backend database queries by supplying crafted input to the `ID` parameter of `/ajax.php?action=calculate_payroll`. The vulnerability stems from unsanitized user-controlled input being embedded directly into SQL statements, enabling data extraction or modification. A public proof-of-concept exploit has been disclosed via GitHub, though no active exploitation has been confirmed in CISA KEV.
SQL injection in code-projects Payroll Management System 1.0 via the ID parameter in /ajax.php?action=save_department allows remote attackers to execute arbitrary SQL commands, potentially compromising backend database content. A public proof-of-concept exploit is available, but no active exploitation has been confirmed (EPSS 0.06%).
A vulnerability classified as critical has been found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in SourceCodester Payroll Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0.php?action=delete_deductions. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in itsourcecode Payroll Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.