CVE-2026-3812

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was determined in itsourcecode Payroll Management System 1.0. Affected is an unknown function of the file /manage_employee_allowances.php. This manipulation of the argument ID causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
itsourcecode	Payroll Management System	1.0

References

https://github.com/ltranquility/cve_submit/issues/10Exploit, Issue Tracking, Mitigation, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.349778Permissions Required, VDB Entry
https://vuldb.com/?id.349778Third Party Advisory, VDB Entry
https://vuldb.com/?submit.769103Third Party Advisory, VDB Entry

Timeline

Published: Mar 9, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-38139.8A vulnerability was identified in opencc JFlow up to 5badc00db382d7cb82dad231e6a866b18e0addfe. Affected by this vulnerability is the functio CVE-2026-38148.8A security flaw has been discovered in UTT HiPER 810G up to 1.7.7-1711. Affected by this issue is the function strcpy of the file /goform/ge CVE-2026-381426.5An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attac CVE-2026-38158.8A weakness has been identified in UTT HiPER 810G up to 1.7.7-1711. This affects the function strcpy of the file /goform/formApMail. Executin CVE-2026-381589.8A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive databa CVE-2026-38166.5A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the f CVE-2026-381659.8A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows at CVE-2026-38175.3A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. This issue affects some unknown processing CVE-2026-38189.8A flaw has been found in Tiandy Easy7 CMS Windows 7.17.0. Impacted is an unknown function of the file /Easy7/apps/WebService/GetDBData.jsp. CVE-2026-38195.4A vulnerability has been found in SourceCodester Resort Reservation System 1.0. The affected element is an unknown function of the file /?pa CVE-2026-38207.2There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR. An attacker may obtain administrator privileges a CVE-2026-38218.8Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH