The vulnerability is a reflected XSS flaw in the index.php file of SourceCodester Sales and Inventory System 1.0. By passing a specially crafted value in the msg query parameter, the application reflects the input unfiltered into the page, enabling a remote attacker to inject any JavaScript or HTML. This can lead to session hijacking, credential theft, or defacement of the website for users who visit the crafted URL.

SourceCodester Sales and Inventory System 1.0. The flaw resides in the front‑end PHP code handling the msg parameter on the index page; no other versions or components are listed as affected.

The severity is moderate, with no CVSS score provided but the risk is real due to the client‑side impact. Exploitation only requires the attacker to motivate a victim to click a crafted link; no authentication or privilege escalation is needed. EPSS data is unavailable, and the vulnerability is not tracked in CISA's KEV catalog.