CVE-2026-9412

A vulnerability was determined in SourceCodester Indian Invoicing System 1.0. Impacted is an unknown function of the component Backend Endpoint. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Multiple endpoints are affected.

CVSS v4.0

2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

0.20% chance of exploitation in the next 30 days, 10th percentile

Published

2026-05-25

Updated

2026-05-27

Proof-of-concept exploits (1)

• https://gist.github.com/c4ttr4ck/db84fc2af3e542acf1eab685264bcfc1

References

• CVE Record
• NVD entry

Related

• CVE-2026-9411
• CVE-2026-9413
• CVE-2026-9410
• CVE-2026-9414
• CVE-2026-9409
• CVE-2026-9415