The itsourcecode Payroll System 1.0 contains a vulnerability in the save_settings function within admin_class.php. Specifically, manipulation of the img argument leads to unrestricted file upload, which can be exploited remotely without authentication or user interaction. This vulnerability is tracked as CVE-2026-78202 and has a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating that it can be exploited over the network with low attack complexity and no privileges or user interaction required, potentially impacting confidentiality, integrity, and availability to a limited extent. Public exploit code exists, but no active exploitation in the wild has been reported. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to upload arbitrary files without restriction, which could lead to limited confidentiality, integrity, and availability impacts. The vulnerability does not require privileges or user interaction, increasing its risk. However, the overall impact is rated medium due to the limited scope of the consequences described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality and monitor for suspicious file uploads. Avoid exposing the vulnerable endpoint to untrusted networks if possible.