CVE-2026-78202: Unrestricted Upload in itsourcecode Payroll System

The itsourcecode Payroll System 1.0 contains an unrestricted upload vulnerability in the save_settings function within admin_class.php. By manipulating the img parameter, an attacker can upload arbitrary files remotely. This vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code is available, increasing the risk of potential exploitation. No official patch or remediation details are provided in the available data.

Successful exploitation allows remote attackers to upload arbitrary files to the system, potentially leading to unauthorized code execution or system compromise. The vulnerability does not require privileges or user interaction, increasing its risk. However, no active exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the vulnerable functionality and validate or sanitize file uploads to prevent malicious files from being uploaded.