CVE-2026-9410

MediumCVSS 4.3

Published: 25/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

A vulnerability was found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b in unknown code of the /profile file in the Profile Workflow component. Manipulation of the ID argument leads to improper authorization. The attack can be launched remotely. The exploit has been publicly disclosed. The vendor did not respond.

Risk Assessment

An attacker can access other users' profiles, leading to privacy breaches and potential data modification.

Recommendation

Restrict access to the /profile file with authentication and authorization, and monitor logs for unauthorized access attempts.

Other vulnerabilities in Invoice-System

CVE-2026-9409Medium
A vulnerability was found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b in an unknown part of the /user file in the User Management Handler component. Manipulation of the role argument leads to improper authorization. The attack can be launched remotely. The exploit has been published. The vendor did not respond.

Original NVD description (English source)

A vulnerability has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b. This vulnerability affects unknown code of the file /profile of the component Profile Workflow. Such manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS