EUVD-2026-31616
GHSA-9q6q-6fwh-p665
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in SourceCodester Indian Invoicing System up to 0.x/1.0. The impacted element is an unknown function of the file /Invoicing/add_order.php of the component Invoice Template Render Database-Backed. The manipulation of the argument customer_name results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Stored cross-site scripting in SourceCodester Indian Invoicing System versions 0.x and 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the customer_name parameter in /Invoicing/add_order.php, which is persisted to the database and executed in the browsers of users who subsequently view the rendered invoice template. A public proof-of-concept exploit is available on GitHub (gist by c4ttr4ck), though EPSS sits at only 0.03% (9th percentile) and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation. Impact is limited to partial integrity on the vulnerable system with no confidentiality or availability consequences, consistent with the CVSS 4.0 score of 2.0.
Technical ContextAI
Indian Invoicing System is a PHP-based web application distributed by SourceCodester, a provider of open-source academic and small-business software. The vulnerability resides in the Invoice Template Render component backed by a database, specifically the customer_name input field processed by /Invoicing/add_order.php. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting): user-supplied input is stored without adequate sanitization or output encoding and later rendered verbatim into HTML, enabling script injection. The database-backed nature of the render pipeline strongly indicates stored (persistent) XSS rather than reflected XSS, meaning a single injection can victimize multiple downstream users who view that invoice. The affected CPE is cpe:2.3:a:sourcecodester:indian_invoicing_system:*:*:*:*:*:*:*:*, covering all known versions through 1.0.
RemediationAI
No vendor-released patch has been identified at time of analysis - no patched version number appears in NVD, VulDB, or EUVD data, and no vendor-issued security advisory was located beyond the SourceCodester product listing. Operators should apply output encoding (e.g., PHP htmlspecialchars() with ENT_QUOTES) to the customer_name field before persisting it to the database and before rendering it in invoice templates; this directly eliminates the injection vector with no functional side effects. Deploying a Content Security Policy (CSP) header restricting inline script execution (script-src 'self') will reduce exploitability of any residual XSS surface, though it may break legitimate inline scripts already in use - audit before deployment. Access to /Invoicing/add_order.php should be restricted to the minimum required user roles via application-level authorization controls, limiting who can submit the malicious payload. The public POC is available at https://gist.github.com/c4ttr4ck/97c5babe1f16fa3243333528a40b7550 and can be used to verify whether mitigations are effective in a test environment.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today