Is there a public PoC exploit available for CVE-2026-9413?

Yes, a public proof-of-concept exploit is available for CVE-2026-9413. Prioritise patching immediately. EPSS: 0.0%.

Indian Invoicing System CVE-2026-9413

Q: What is the CVSS score of CVE-2026-9413?

CVE-2026-9413 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31615 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 VulDB

GHSA-wjc2-8759-9j3c

PHP XSS Indian Invoicing System

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:10 vuln.today

Severity Changed

May 26, 2026 - 19:37 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:37 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was identified in SourceCodester Indian Invoicing System 1.0. The affected element is an unknown function of the file /Invoicing/category.php. The manipulation of the argument msg leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

Reflected cross-site scripting (XSS) in SourceCodester Indian Invoicing System 1.0 allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser by manipulating the msg parameter in /Invoicing/category.php. A proof-of-concept exploit is publicly available on GitHub. Despite the public POC, EPSS stands at just 0.03% (10th percentile) and the vulnerability is absent from CISA KEV, reflecting the narrow deployment footprint of this niche PHP invoicing application and the user-interaction requirement that limits automated exploitation.

Technical ContextAI

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied data in the msg HTTP parameter is echoed back into the rendered HTML response of /Invoicing/category.php without adequate sanitization or output encoding. The application is PHP-based (per VulDB tags), a language ecosystem where direct variable interpolation into HTML output is a common root cause of reflected XSS. The CPE string cpe:2.3:a:sourcecodester:indian_invoicing_system:*:*:*:*:*:*:*:* indicates the affected product is SourceCodester's Indian Invoicing System, a freely distributed PHP web application. The CVSS 4.0 vector confirms network delivery (AV:N), low attack complexity (AC:L), no authentication required from the attacker (PR:N), and passive user interaction needed from the victim (UI:P), consistent with a classic server-reflected XSS pattern.

RemediationAI

No vendor-released patch has been identified at time of analysis for SourceCodester Indian Invoicing System 1.0; organizations should monitor the vendor site (https://www.sourcecodester.com/) and VulDB (https://vuldb.com/vuln/365394) for updates. As an immediate compensating control, developers should apply htmlspecialchars() or equivalent output encoding to the msg parameter before rendering it in /Invoicing/category.php, eliminating the unsanitized reflection. Deploying a Content Security Policy (CSP) response header with a restrictive script-src directive can significantly reduce the exploitability of any remaining XSS vectors, though this requires testing to avoid breaking legitimate application functionality. Web application firewall (WAF) rules filtering common XSS payloads on the msg parameter provide an additional detection and blocking layer. Restricting internet exposure of the application to only authorized internal users reduces the attack surface, given that the exploit requires victim interaction with a crafted URL.