The vulnerability is a reflected cross‑site scripting flaw found in the index.php file of SourceCodester Sales and Inventory System version 1.0. The application does not sanitize the "msg" query parameter, allowing attackers to inject arbitrary JavaScript or HTML when they visit a crafted URL. Consequently, a malicious user could execute scripts in the victim's browser, potentially stealing session cookies, defacing the site, or redirecting users to phishing pages.

Affected systems are the SourceCodester Sales and Inventory System 1.0 web application, specifically the index.php handler that processes the "msg" parameter. The product is identified by the CPE string cpe:2.3:a:ahsanriaz26gmailcom:sales_and_inventory_system:1.0. No other versions or vendors are currently listed as affected.

The CVSS base score of 6.1 indicates a medium impact, while the EPSS score of less than 1% suggests that very few attackers have exploited this flaw so far. The vulnerability is not catalogued in CISA’s KEV list. An attacker can trigger the flaw simply by visiting a malicious URL, meaning the attack does not require authentication or privileged access. While the likelihood of exploitation is low, the potential for client‑side compromise warrants caution, especially if users visit suspicious links.