CVE-2026-81202CWE-287CWE-306

CVE-2026-81202

High · published August 27, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00693 · 52.3th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2026-08-27T02:16Z
References (7)
https://github.com/microwaveabi/vul/issues/7 · [email protected]https://itsourcecode.com/ · [email protected]https://vuldb.com/cve/CVE-2026-81202 · [email protected]https://vuldb.com/submit/886151 · [email protected]https://vuldb.com/submit/886152 · [email protected]https://vuldb.com/vuln/395909 · [email protected]https://vuldb.com/vuln/395909/cti · [email protected]
EPSS history
Timeline
  • 28 AUG 06:54Z
    EPSS moved — → 0%
    epss
  • 26 AUG 21:30Z
    itsourcecode Payroll System CRUD Operation ajax.php delete missing authentication
    cvelistv5