The vulnerability CVE-2026-78201 affects itsourcecode Payroll System version 1.0. It is located in the Login function within the admin_class.php file. By manipulating the Username parameter, an attacker can inject SQL commands remotely, potentially compromising the backend database. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Although exploit code is publicly available, there is no vendor advisory or patch information provided at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, modification, or other database impacts depending on the database permissions and environment. The medium CVSS score reflects limited complexity and no required privileges or user interaction for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or mitigations recommended by the vendor. Monitoring for suspicious activity related to login attempts may help detect exploitation attempts.