CVE-2026-9413
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A cross-site scripting vulnerability was found in SourceCodester Indian Invoicing System 1.0 in the file /Invoicing/category.php. Manipulation of the msg argument allows remote injection of malicious scripts. The exploit is publicly available.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other actions in their context. The risk is high due to the availability of the exploit.
Recommendation
Immediately update the system to the latest version or apply the vendor's patch. If not possible, remove or secure the /Invoicing/category.php file against unauthorized access.
Other vulnerabilities in SourceCodester Indian Invoicing System
See all- CVE-2026-9414Low
In SourceCodester Indian Invoicing System up to version 1.0, the file /Invoicing/add_order.php in the Invoice Template Render Database-Backed component is vulnerable to cross-site scripting via the customer_name argument. The attack can be launched remotely, and the exploit has been publicly released.
- CVE-2026-9411Medium
A SQL Injection vulnerability has been found in SourceCodester Indian Invoicing System 1.0 in the file /Invoicing/IGST_Invoice.php of the Invoice Generation Handler component. Manipulation of the customer_name/category arguments leads to SQL injection. The attack can be initiated remotely, and the exploit has been made public.
Original NVD description (English source)
A vulnerability was identified in SourceCodester Indian Invoicing System 1.0. The affected element is an unknown function of the file /Invoicing/category.php. The manipulation of the argument msg leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.