Is there a public PoC exploit available for CVE-2026-9411?

Yes, a public proof-of-concept exploit is available for CVE-2026-9411. Prioritise patching immediately. EPSS: 0.0%.

Indian Invoicing System CVE-2026-9411

Q: What is the CVSS score of CVE-2026-9411?

CVE-2026-9411 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31614 LOW

SQL Injection (CWE-89)

2026-05-25 VulDB

GHSA-j3g5-9h55-35wh

PHP SQLi Indian Invoicing System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:23 vuln.today

Severity Changed

May 26, 2026 - 19:37 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:37 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was found in SourceCodester Indian Invoicing System 1.0. This issue affects some unknown processing of the file /Invoicing/IGST_Invoice.php of the component Invoice Generation Handler. Performing a manipulation of the argument customer_name/category results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester Indian Invoicing System 1.0 allows a remote, low-privileged authenticated attacker to manipulate database queries through the customer_name and category parameters in /Invoicing/IGST_Invoice.php. The vulnerability yields partial confidentiality, integrity, and availability impact against the underlying database. No public exploit identified at time of analysis is incorrect - publicly available exploit code exists (GitHub gist), though the application is a niche, open-source invoicing tool with limited deployment footprint and no confirmed active exploitation in the wild.

Technical ContextAI

The affected component is a PHP-based Invoice Generation Handler within SourceCodester Indian Invoicing System 1.0, identified by CPE cpe:2.3:a:sourcecodester:indian_invoicing_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input in the customer_name and/or category parameters is concatenated directly into SQL queries without proper parameterization or escaping. SourceCodester is a community platform that distributes free PHP-based web applications, typically used by students and small businesses, and these codebases frequently lack security controls such as prepared statements or ORM abstraction layers.

RemediationAI

No vendor-released patch has been identified at time of analysis; there is no official security advisory from SourceCodester with a fixed version. Organizations running Indian Invoicing System 1.0 should apply parameterized queries or prepared statements to all database interactions in /Invoicing/IGST_Invoice.php, replacing any direct string concatenation of customer_name and category into SQL statements - this is the definitive fix but requires code modification. As a compensating control, deploying a Web Application Firewall (WAF) with SQLi detection rules in front of the application can block common SQL injection patterns, though sophisticated payloads may bypass signature-based rules. Restricting access to the /Invoicing/ path to authenticated internal users only via network-level controls (firewall, VPN, or .htaccess IP restriction) reduces attack surface, with the trade-off of limiting legitimate remote access. Reference: https://vuldb.com/vuln/365392 and https://nvd.nist.gov/vuln/detail/CVE-2026-9411.