CVE-2026-9413: Sourcecodester Indian Invoicing System

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability was identified in SourceCodester Indian Invoicing System 1.0. The affected element is an unknown function of the file /Invoicing/category.php. The manipulation of the argument msg leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.

Affected products

• Sourcecodester Indian Invoicing System: version 1.0 only

Published 2026-05-25. Last modified 2026-07-20.