# CVE-2026-9414: SourceCodester Indian Invoicing System stored XSS in add_order.php

Source: https://junglewise.ai/threats/cve-2026-9414-sourcecodester-indian-invoicing-system-stored-xss-in-add-order-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-9414 · Severity: low · CVSS 3.5 · Published 2026-05-25

A security vulnerability exists in the SourceCodester Indian Invoicing System, a web application used for managing business invoices. An attacker can inject malicious scripts into customer name fields, which are then executed in the browsers of other users, such as staff or administrators, when they view the affected invoices. This could lead to unauthorized actions being performed in the context of the victim's session or the theft of sensitive session information.

Technologies: [SourceCodester Indian Invoicing System](https://junglewise.ai/threats/technologies/indian-invoicing-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-9414 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9414 being exploited in the wild.

**How severe is CVE-2026-9414?** Low severity, with a CVSS score of 3.5, published 25 May 2026.

**Which products and versions are affected?** SourceCodester Indian Invoicing System 0.x/1.0.

**Is there a fix for CVE-2026-9414?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9414 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9414?** Check whether you run SourceCodester Indian Invoicing System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Indian Invoicing System up to version 1.0. The root cause is the failure of the application to perform output encoding when rendering database-backed values in the invoice templates located in /Invoice.php and /IGST_Invoice.php. A remote attacker with low privileges can submit a malicious payload via the 'customer_name' parameter in a POST request to /Invoicing/add_order.php. When an authenticated user views the rendered invoice, the injected JavaScript executes in their browser context. This can be used to hijack sessions or perform unauthorized actions on behalf of the victim. Public exploit code (PoC) is available.

## Affected products

- SourceCodester Indian Invoicing System 0.x/1.0

## Timeline

- 2026-04-26: other: Vulnerability discovered and PoC created by researcher
- 2026-05-25: advisory: Initial disclosure date

## References

- [https://gist.github.com/c4ttr4ck/97c5babe1f16fa3243333528a40b7550](https://gist.github.com/c4ttr4ck/97c5babe1f16fa3243333528a40b7550)
- [https://vuldb.com/submit/813610](https://vuldb.com/submit/813610)
- [https://vuldb.com/vuln/365395](https://vuldb.com/vuln/365395)
- [https://vuldb.com/vuln/365395/cti](https://vuldb.com/vuln/365395/cti)
- [https://www.sourcecodester.com/](https://www.sourcecodester.com/)

## Related threats

- [SourceCodester Indian Invoicing System XSS and SQLi in category.php](https://junglewise.ai/threats/cve-2026-9413-sourcecodester-indian-invoicing-system-xss-and-sqli-in-category)
- [SourceCodester Indian Invoicing System improper access control in backend endpoints](https://junglewise.ai/threats/cve-2026-9412-sourcecodester-indian-invoicing-system-improper-access-control-in)
- [SourceCodester Indian Invoicing System SQL injection in IGST_Invoice.php](https://junglewise.ai/threats/cve-2026-9411-sourcecodester-indian-invoicing-system-sql-injection-in-igst)