A cross‑site scripting flaw was identified in the Payroll Management System’s index page, where manipulating the “page” argument allows arbitrary JavaScript injection into the browser. The vulnerability is anchored in a missing or improper output encoding and falls under the CWE‑79 security weakness. An attacker can exploit this flaw remotely by crafting a URL that delivers malicious scripts to a victim’s session. This can lead to credential theft, session hijacking, defacement, or the execution of additional attack payloads within the victim’s browser context.

The flaw affects itsourcecode’s Payroll Management System up to version 1.0. The vulnerable functionality resides in the /index.php file and is triggered by the page parameter. Users running any release at or below v1.0 risk exposure if the page argument is not properly sanitized.

The CVSS score of 5.3 indicates a moderate impact, primarily affecting confidentiality and integrity at the user level. No EPSS score is provided and the vulnerability is not listed in the KEV catalog; however, the public release of the exploit means that the attack path is well known. The vulnerability can be invoked purely through a crafted HTTP request, with no authentication or privilege escalation required. As such, any exposed instance of the affected system poses a tangible risk to users who interact with the index page.