CVE-2026-9414
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In SourceCodester Indian Invoicing System up to version 1.0, the file /Invoicing/add_order.php in the Invoice Template Render Database-Backed component is vulnerable to cross-site scripting via the customer_name argument. The attack can be launched remotely, and the exploit has been publicly released.
Risk Assessment
The risk is remote execution of scripts in the victim's browser, potentially leading to session theft, defacement, or data theft.
Recommendation
Update the system to the latest patched version, or manually sanitize input in add_order.php to prevent XSS.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Indian Invoicing System up to 0.x/1.0. The impacted element is an unknown function of the file /Invoicing/add_order.php of the component Invoice Template Render Database-Backed. The manipulation of the argument customer_name results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.