The itsourcecode Payroll Management System up to version 1.0 contains a cross-site scripting vulnerability in the /navbar.php file. Specifically, the 'page' argument is not properly sanitized, allowing an attacker to inject malicious scripts. This vulnerability can be triggered remotely without authentication and requires user interaction to exploit. The CVSS 4.0 base score is 5.3, indicating medium severity. No vendor advisory or patch information is provided, and no known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application for users who interact with the manipulated 'page' parameter. This may lead to session hijacking, defacement, or other client-side attacks. However, the attack requires user interaction and does not grant direct system-level access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and applying input validation or web application firewall rules to detect and block malicious payloads targeting the 'page' parameter.