CVE-2026-24913

CVE-2026-24913 is a SQL injection vulnerability affecting MATCHA INVOICE version 2.6.6 and earlier that allows authenticated users to query, obtain, or modify database information. The vulnerability carries a high CVSS score of 8.8, with a network attack vector, low complexity, and low privilege requirements, resulting in high impact across confidentiality, integrity, and availability. While the EPSS score indicates relatively low probability of exploitation in the wild at 0.000350000, the vulnerability has a moderate FAUCET risk score of 52.0 out of 100. The vulnerability is not currently tracked on the Known Exploited Vulnerabilities catalog and shows no signs of active exploitation or widespread community attention. Organizations running MATCHA INVOICE 2.6.6 or earlier should prioritize patching, as the attack requires only valid login credentials but poses significant data compromise risks.