Is there a public PoC exploit available for CVE-2026-14791?

Yes, a public proof-of-concept exploit is available for CVE-2026-14791. Prioritise patching immediately. EPSS: 0.2%.

Crater Invoice CVE-2026-14791

Q: What is the CVSS score of CVE-2026-14791?

CVE-2026-14791 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41802 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-07-06 VulDB

GHSA-pjgh-hr58-wj7w

PHP XSS Crater

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable stored XSS requiring low-privilege auth and victim interaction; scope changes to victim browser enabling session-level confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jul 06, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jul 06, 2026 - 03:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

Analysis Generated

Jul 06, 2026 - 03:21 vuln.today

DescriptionCVE.org

A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Cross-site scripting in Crater invoice application (up to v6.0.6) allows an authenticated attacker to inject malicious script payloads via the invoice notes field, executing in the browser of any user who subsequently views the crafted invoice. The vulnerable function getFormattedString in app/Http/Requests/InvoicesRequest.php performs insufficient neutralization of the notes argument, classified under CWE-79. A public proof-of-concept exploit exists; no vendor patch has been released as the project has not responded to the coordinated disclosure made via GitHub issue #1327.

Technical ContextAI

Crater is a PHP-based open-source invoicing application (cpe:2.3:a:crater-invoice-inc:crater:*:*:*:*:*:*:*:*). The flaw resides in the Invoice Note Handler component, specifically the getFormattedString function within app/Http/Requests/InvoicesRequest.php, which processes the notes argument submitted during invoice creation or editing. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates a failure to encode or sanitize user-supplied HTML/JavaScript before rendering it in the browser. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms the vulnerability is network-reachable with low attack complexity, requires low-level authentication, and depends on passive victim interaction - consistent with stored XSS behavior where the payload persists server-side and executes when another user loads the affected invoice view.

RemediationAI

No vendor-released patch has been identified at time of analysis; the project was notified via GitHub issue #1327 (https://github.com/crater-invoice-inc/crater/issues/1327) but has not responded. Operators should monitor the GitHub repository and VulDB entry (https://vuldb.com/vuln/376385) for patch availability. As immediate compensating controls, restrict invoice creation and editing privileges to the minimum set of trusted users - reducing the attacker pool. Implement a Web Application Firewall rule to strip or block script injection patterns in the notes field, noting this may interfere with legitimate rich-text content. Enforce a strict Content-Security-Policy header (e.g., script-src 'self') to block inline script execution, which mitigates XSS payload impact even if injection succeeds. Organizations with the technical capacity to fork or patch locally can add output encoding (e.g., htmlspecialchars in PHP) to the notes rendering path in app/Http/Requests/InvoicesRequest.php as a direct fix.