PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9413 SourceCodester CVE debrief

A cross-site scripting (XSS) vulnerability exists in SourceCodester Indian Invoicing System 1.0, specifically within the `/Invoicing/category.php` file. The `msg` parameter is susceptible to manipulation, allowing remote attackers to inject malicious scripts. The CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, but user interaction is required. The vulnerability has a LOW severity rating with a score of 2.1. The exploit is publicly available per source documentation. The CVE was published on 2026-05-25 and last modified on 2026-05-26. The vulnerability status in NVD is currently 'Deferred'.

Vendor
SourceCodester
Product
Indian Invoicing System
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-07-20
Advisory published
2026-05-25
Advisory updated
2026-07-20

Who should care

Organizations using SourceCodester Indian Invoicing System 1.0; security teams monitoring PHP-based invoicing applications; developers maintaining legacy PHP applications without modern input sanitization frameworks

Technical summary

The vulnerability is a reflected or stored XSS issue in the Indian Invoicing System 1.0. The attack surface is the `msg` parameter in `/Invoicing/category.php`. Successful exploitation requires user interaction (UI:R in CVSS 4.0), suggesting a reflected XSS scenario where an attacker must trick a victim into visiting a crafted URL. The confidentiality impact is rated as LOW (VC:L) with no integrity or availability impact to the vulnerable component. The exploit is publicly available, increasing the likelihood of attempted exploitation.

Defensive priority

low

Recommended defensive actions

  • Review and sanitize all user-supplied input to the `msg` parameter in `/Invoicing/category.php`
  • Implement output encoding appropriate for the context (HTML entity encoding for HTML content)
  • Consider Content Security Policy (CSP) headers to mitigate impact of XSS vulnerabilities
  • Validate that the application uses modern PHP frameworks with built-in XSS protections
  • Monitor for unauthorized access attempts targeting the category.php endpoint

Evidence notes

Source references include a GitHub Gist containing vulnerability details, VulDB submission and vulnerability pages, and the SourceCodester vendor website. The CVSS 4.0 vector string is provided in source metadata. Weaknesses are classified as CWE-79 (Cross-site Scripting) and CWE-94 (Code Injection) per VulDB CNA.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9413 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9413

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9413 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9413

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.