Description
A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used.
Published: 2026-08-26
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Deletion
Action: Apply Patch
AI Analysis

Impact

The flaw in itsourcecode Payroll System 1.0 is located in the CRUD operation handler of ajax.php, where manipulating the action parameter allows an attacker to execute delete actions without providing valid credentials. This capability enables remote attackers to remove payroll data, thereby compromising the integrity of the system and potentially affecting availability. The vulnerability is driven by improper authentication and missing authentication checks (CWE-287, CWE-306).

Affected Systems

The vulnerability impacts the itsourcecode Payroll System, specifically version 1.0. No other affected versions are listed. The product is referenced by the CPE cpe:2.3:a:itsourcecode:payroll_system:*:*:*:*:*:*:*:* .

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. An exploit can be conducted remotely by sending crafted HTTP requests that manipulate the action argument. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw involves missing authentication, it is likely to be readily exploitable by attackers who can observe or guess valid endpoints.

Generated by OpenCVE AI on August 26, 2026 at 23:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Payroll System to a version that implements authentication checks for CRUD operations.
  • If an upgrade is not immediately possible, restrict direct access to ajax.php using web‑server access controls or IP whitelisting to prevent unauthenticated requests.
  • Continuously monitor web logs for unauthorized delete requests and configure alerts for suspicious activity.

Generated by OpenCVE AI on August 26, 2026 at 23:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used.
Title itsourcecode Payroll System CRUD Operation ajax.php delete missing authentication
First Time appeared Itsourcecode
Itsourcecode payroll System
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:a:itsourcecode:payroll_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode payroll System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Payroll System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-27T15:18:33.470Z

Reserved: 2026-08-26T16:38:22.163Z

Link: CVE-2026-81202

cve-icon Vulnrichment

Updated: 2026-08-27T15:18:21.771Z

cve-icon NVD

Status : Deferred

Published: 2026-08-26T22:16:30.293

Modified: 2026-08-28T15:09:00.790

Link: CVE-2026-81202

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T23:45:03Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function