Is there a public PoC exploit available for EUVD-2026-31616?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31616. Prioritise patching immediately. EPSS: 0.0%.

Indian Invoicing System EUVD-2026-31616

Q: What is the CVSS score of EUVD-2026-31616?

EUVD-2026-31616 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9414 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 VulDB

GHSA-9q6q-6fwh-p665

PHP XSS Indian Invoicing System

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:24 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

3.5 (LOW) 2.0 (LOW)

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Indian Invoicing System up to 0.x/1.0. The impacted element is an unknown function of the file /Invoicing/add_order.php of the component Invoice Template Render Database-Backed. The manipulation of the argument customer_name results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Stored cross-site scripting in SourceCodester Indian Invoicing System versions 0.x and 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the customer_name parameter in /Invoicing/add_order.php, which is persisted to the database and executed in the browsers of users who subsequently view the rendered invoice template. A public proof-of-concept exploit is available on GitHub (gist by c4ttr4ck), though EPSS sits at only 0.03% (9th percentile) and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation. Impact is limited to partial integrity on the vulnerable system with no confidentiality or availability consequences, consistent with the CVSS 4.0 score of 2.0.

Technical ContextAI

Indian Invoicing System is a PHP-based web application distributed by SourceCodester, a provider of open-source academic and small-business software. The vulnerability resides in the Invoice Template Render component backed by a database, specifically the customer_name input field processed by /Invoicing/add_order.php. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting): user-supplied input is stored without adequate sanitization or output encoding and later rendered verbatim into HTML, enabling script injection. The database-backed nature of the render pipeline strongly indicates stored (persistent) XSS rather than reflected XSS, meaning a single injection can victimize multiple downstream users who view that invoice. The affected CPE is cpe:2.3:a:sourcecodester:indian_invoicing_system:*:*:*:*:*:*:*:*, covering all known versions through 1.0.

RemediationAI

No vendor-released patch has been identified at time of analysis - no patched version number appears in NVD, VulDB, or EUVD data, and no vendor-issued security advisory was located beyond the SourceCodester product listing. Operators should apply output encoding (e.g., PHP htmlspecialchars() with ENT_QUOTES) to the customer_name field before persisting it to the database and before rendering it in invoice templates; this directly eliminates the injection vector with no functional side effects. Deploying a Content Security Policy (CSP) header restricting inline script execution (script-src 'self') will reduce exploitability of any residual XSS surface, though it may break legitimate inline scripts already in use - audit before deployment. Access to /Invoicing/add_order.php should be restricted to the minimum required user roles via application-level authorization controls, limiting who can submit the malicious payload. The public POC is available at https://gist.github.com/c4ttr4ck/97c5babe1f16fa3243333528a40b7550 and can be used to verify whether mitigations are effective in a test environment.