Indian Invoicing System EUVD-2026-31615

Exploitation requires passive user interaction: a victim user must click a crafted link or otherwise trigger a browser request to /Invoicing/category.php with attacker-controlled content in the msg parameter (confirmed by CVSS UI:P). The attacker requires no authentication (PR:N per CVSS), but the victim must have access to the running application. The attack is not automatable per SSVC, meaning mass exploitation without victim interaction is not feasible. The application must be network-reachable to the attacker (AV:N). No special non-default configuration is described as required - the vulnerable code path in /Invoicing/category.php appears to be part of standard application functionality. Exploitation is further constrained by the application's limited deployment footprint as a niche open-source PHP invoicing tool, and the technical impact is bounded to partial integrity loss (VI:L) with no confidentiality exposure.

The CVSS 4.0 base score of 2.1 (Low) is well-calibrated for this vulnerability. The vector confirms network reachability (AV:N), no complexity or preconditions (AC:L/AT:N), no attacker privileges (PR:N), but mandatory passive victim interaction (UI:P), and impact limited to partial integrity loss (VI:L) with no confidentiality or availability impact across either the vulnerable or downstream components. EPSS at 0.03% (10th percentile) independently corroborates low exploitation probability. SSVC signals align: exploitation status is POC-only, the attack is not automatable (consistent with the UI:P requirement), and technical impact is partial. The vulnerability is not listed in CISA KEV, meaning no confirmed in-the-wild exploitation has been recorded. The public POC raises the theoretical risk marginally above zero, but the combination of user-interaction dependency, negligible EPSS, non-automatable SSVC rating, and niche application footprint makes this a low real-world priority for most organizations. No conflicting signals between data sources were identified.

A publicly available proof-of-concept exploit exists on GitHub (https://gist.github.com/c4ttr4ck/cb6a07bc54600a14de2676d8b96c3026). An attacker crafts a malicious URL targeting the msg parameter of /Invoicing/category.php - for example embedding a <script> tag or event handler - and delivers it to a target user via phishing email or a malicious redirect. When the victim clicks the link and their browser loads the page, the unsanitized msg value is reflected into the HTML response and the injected script executes in the victim's browser session, enabling potential session cookie theft, credential harvesting, or UI redressing within the invoicing application.