The vulnerability CVE-2026-5238 affects itsourcecode Payroll Management System 1.0. It is caused by improper handling of the ID parameter in the /view_employee.php file's Parameter Handler component, allowing an attacker to perform SQL injection. This can be exploited remotely without any privileges or user interaction. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No patch or official fix information is currently available, and the vendor has not provided advisory details. Exploit code has been publicly disclosed, but no active exploitation has been confirmed.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification within the Payroll Management System. The impact is rated medium based on the CVSS score of 6.9, reflecting the potential for limited confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing input validation and parameterized queries as temporary mitigations to reduce the risk of SQL injection. Monitoring for unusual database queries may also help detect exploitation attempts.