CVE-2026-9411
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A SQL Injection vulnerability has been found in SourceCodester Indian Invoicing System 1.0 in the file /Invoicing/IGST_Invoice.php of the Invoice Generation Handler component. Manipulation of the customer_name/category arguments leads to SQL injection. The attack can be initiated remotely, and the exploit has been made public.
Risk Assessment
Risk of database data leakage, including customer and invoice data, as well as potential data modification or deletion.
Recommendation
Immediately validate and sanitize input in IGST_Invoice.php and use parameterized queries.
Other vulnerabilities in SourceCodester Indian Invoicing System
See all- CVE-2026-9414Low
In SourceCodester Indian Invoicing System up to version 1.0, the file /Invoicing/add_order.php in the Invoice Template Render Database-Backed component is vulnerable to cross-site scripting via the customer_name argument. The attack can be launched remotely, and the exploit has been publicly released.
- CVE-2026-9413Medium
A cross-site scripting vulnerability was found in SourceCodester Indian Invoicing System 1.0 in the file /Invoicing/category.php. Manipulation of the msg argument allows remote injection of malicious scripts. The exploit is publicly available.
Original NVD description (English source)
A vulnerability was found in SourceCodester Indian Invoicing System 1.0. This issue affects some unknown processing of the file /Invoicing/IGST_Invoice.php of the component Invoice Generation Handler. Performing a manipulation of the argument customer_name/category results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.