Vulnerability · Published Aug 24, 2026 · Assigned by VulDB
CVE-2026-78202itsourcecode Payroll System admin_class.php save_settings unrestricted upload
High 7.3
In plain English
A high-severity unrestricted file upload in Payroll System from itsourcecode. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.5%top 57.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| itsourcecode | Payroll System | 1.0 |
Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-394579 | itsourcecode Payroll System admin_class.php save_settings unrestricted upload vdb-entry, technical-description
- VDB-394579 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-78202 | CVE Analysis and Report third-party-advisory
- Submit #886159 | itsourcecode Payroll System 1.0 Unrestricted Upload third-party-advisory
- https://github.com/microwaveabi/vul/issues/12 exploit, issue-tracking
- https://itsourcecode.com/ product