A security vulnerability in itsourcecode Payroll Management System allows an attacker to manipulate the ID argument in the /manage_employee_deductions.php file. The improper handling of this parameter can result in cross‑site scripting (CWE‑79) and, because the injection can occur in an execution context, also shows characteristics of code injection (CWE‑94). The injected script would be rendered by the victim’s browser, allowing arbitrary client‑side code execution, which is typical for XSS vulnerabilities.

The affected product is itsourcecode Payroll Management System version 1.0. The specific vulnerable file is /manage_employee_deductions.php. No additional affected versions are disclosed in the CVE data.

The CVSS score of 5.3 indicates a moderate risk level, while the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote: an attacker can send a crafted HTTP request with a malicious ID value to the vulnerable endpoint, causing the application to render the injected script. No official patch or workaround is provided, so the risk largely depends on the ability of an attacker to reach the vulnerable endpoint and successfully inject script.