Is there a public PoC exploit available for CVE-2026-9412?

Yes, a public proof-of-concept exploit is available for CVE-2026-9412. Prioritise patching immediately. EPSS: 0.0%.

Indian Invoicing System CVE-2026-9412

Q: What is the CVSS score of CVE-2026-9412?

CVE-2026-9412 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31613 LOW

Improper Access Control (CWE-284)

2026-05-25 VulDB

GHSA-prjj-f47h-rrr3

Authentication Bypass Indian Invoicing System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:09 vuln.today

Severity Changed

May 26, 2026 - 19:37 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:37 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was determined in SourceCodester Indian Invoicing System 1.0. Impacted is an unknown function of the component Backend Endpoint. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Multiple endpoints are affected.

AnalysisAI

Improper access control across multiple backend endpoints in SourceCodester Indian Invoicing System 1.0 permits authenticated low-privilege users to reach restricted functionality beyond their authorization level. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms remote exploitation requiring only low-level credentials, with confidentiality, integrity, and availability all assessed at low impact across the vulnerable system. A publicly available proof-of-concept exploit exists (hosted on GitHub), though EPSS remains at 0.04% (11th percentile) and the vulnerability is not in the CISA KEV catalog, indicating no confirmed widespread exploitation at time of analysis.

Technical ContextAI

The affected product is SourceCodester Indian Invoicing System 1.0, a PHP-based web invoicing application (CPE: cpe:2.3:a:sourcecodester:indian_invoicing_system:*:*:*:*:*:*:*:*). The root cause is CWE-284 (Improper Access Control), a class of vulnerability where server-side backend endpoints fail to enforce adequate authorization checks before performing privileged operations. Specifically, the application does not properly restrict which authenticated users can invoke certain backend endpoint functions, allowing lateral privilege escalation or unauthorized data access within the application. The 'Authentication Bypass' tag in the threat intelligence data suggests that access controls on multiple endpoints can be circumvented by a user who holds any valid session, effectively bypassing role-based or function-level restrictions the application intends to enforce.

RemediationAI

No vendor-released patch has been identified at time of analysis - the SourceCodester vendor has not published a security advisory or fixed release for Indian Invoicing System 1.0. As a compensating control, administrators should restrict access to the affected backend endpoints by implementing server-level access controls (e.g., .htaccess rules or web server configuration) to block low-privilege users from invoking sensitive endpoint paths; the trade-off is potential disruption to legitimate application functionality if endpoint paths are shared. Additionally, reducing the number of active user accounts to only those with operational necessity limits the attack surface given the PR:L requirement. Network-level controls (placing the application behind a VPN or firewall that restricts access to trusted networks) reduce remote exposure. Monitor VulDB submission https://vuldb.com/submit/813608 and the GitHub PoC at https://gist.github.com/c4ttr4ck/db84fc2af3e542acf1eab685264bcfc1 for updated patch guidance. Organizations requiring a fix should consider forking and patching the access control logic directly in the application source.