CVE-2026-9414
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In SourceCodester Indian Invoicing System up to version 1.0, the file /Invoicing/add_order.php in the Invoice Template Render Database-Backed component is vulnerable to cross-site scripting via the customer_name argument. The attack can be launched remotely, and the exploit has been publicly released.
Risk Assessment
The risk is remote execution of scripts in the victim's browser, potentially leading to session theft, defacement, or data theft.
Recommendation
Update the system to the latest patched version, or manually sanitize input in add_order.php to prevent XSS.
Other vulnerabilities in SourceCodester Indian Invoicing System
See all- CVE-2026-9413Medium
A cross-site scripting vulnerability was found in SourceCodester Indian Invoicing System 1.0 in the file /Invoicing/category.php. Manipulation of the msg argument allows remote injection of malicious scripts. The exploit is publicly available.
- CVE-2026-9411Medium
A SQL Injection vulnerability has been found in SourceCodester Indian Invoicing System 1.0 in the file /Invoicing/IGST_Invoice.php of the Invoice Generation Handler component. Manipulation of the customer_name/category arguments leads to SQL injection. The attack can be initiated remotely, and the exploit has been made public.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Indian Invoicing System up to 0.x/1.0. The impacted element is an unknown function of the file /Invoicing/add_order.php of the component Invoice Template Render Database-Backed. The manipulation of the argument customer_name results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS