PatchSiren cyber security CVE debrief
CVE-2026-9413 SourceCodester CVE debrief
A cross-site scripting (XSS) vulnerability exists in SourceCodester Indian Invoicing System 1.0, specifically within the `/Invoicing/category.php` file. The `msg` parameter is susceptible to manipulation, allowing remote attackers to inject malicious scripts. The CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, but user interaction is required. The vulnerability has a LOW severity rating with a score of 2.1. The exploit is publicly available per source documentation. The CVE was published on 2026-05-25 and last modified on 2026-05-26. The vulnerability status in NVD is currently 'Deferred'.
- Vendor
- SourceCodester
- Product
- Indian Invoicing System
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-25
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-25
- Advisory updated
- 2026-05-26
Who should care
Organizations using SourceCodester Indian Invoicing System 1.0; security teams monitoring PHP-based invoicing applications; developers maintaining legacy PHP applications without modern input sanitization frameworks
Technical summary
The vulnerability is a reflected or stored XSS issue in the Indian Invoicing System 1.0. The attack surface is the `msg` parameter in `/Invoicing/category.php`. Successful exploitation requires user interaction (UI:R in CVSS 4.0), suggesting a reflected XSS scenario where an attacker must trick a victim into visiting a crafted URL. The confidentiality impact is rated as LOW (VC:L) with no integrity or availability impact to the vulnerable component. The exploit is publicly available, increasing the likelihood of attempted exploitation.
Defensive priority
low
Recommended defensive actions
- Review and sanitize all user-supplied input to the `msg` parameter in `/Invoicing/category.php`
- Implement output encoding appropriate for the context (HTML entity encoding for HTML content)
- Consider Content Security Policy (CSP) headers to mitigate impact of XSS vulnerabilities
- Validate that the application uses modern PHP frameworks with built-in XSS protections
- Monitor for unauthorized access attempts targeting the category.php endpoint
Evidence notes
Source references include a GitHub Gist containing vulnerability details, VulDB submission and vulnerability pages, and the SourceCodester vendor website. The CVSS 4.0 vector string is provided in source metadata. Weaknesses are classified as CWE-79 (Cross-site Scripting) and CWE-94 (Code Injection) per VulDB CNA.
Official resources
The vulnerability was disclosed through VulDB and is tracked in the NVD with deferred status. Public exploit availability is confirmed in source references.