CVE-2026-78201: SQL Injection in itsourcecode Payroll System

This vulnerability affects itsourcecode Payroll System 1.0 specifically in the Login function within admin_class.php. An attacker can remotely exploit the SQL injection by manipulating the Username parameter, potentially allowing unauthorized database queries. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Public exploit details have been disclosed, but no vendor patch or remediation guidance is available in the provided data.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform SQL injection attacks via the Username parameter in the login function. This may lead to unauthorized access or manipulation of the payroll system's database. The impact is rated medium severity based on CVSS 6.9, reflecting limited but significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing input validation and parameterized queries as temporary mitigations to reduce SQL injection risk.