CVE-2026-78202

Publié : 24 août 2026

Modifié : 24 août 2026

Score CVSS

7.3

HIGH

Description détaillée

A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://github.com/microwaveabi/vul/issues/12 https://itsourcecode.com/https://vuldb.com/cve/CVE-2026-78202 https://vuldb.com/submit/886159 https://vuldb.com/vuln/394579 https://vuldb.com/vuln/394579/cti

Dernières Vulnérabilités

CVE-2026-78323

A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In non-default configurations where certificate revocation checking is disabled, this could allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections.

VOIR DÉTAILS

CVE-2026-78291

Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.

VOIR DÉTAILS

CVE-2026-78290

Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.

VOIR DÉTAILS