A reflected XSS flaw exists in the add_category.php module of SourceCodester Sales and Inventory System 1.0, allowing an attacker to inject arbitrary script or HTML through the unsanitized "msg" parameter. If successfully exploited, the injected code runs with the privileges of the victim who views the crafted page, potentially enabling session hijacking, credential theft, and defacement of the application. The vulnerability is a classic cross‑site scripting weakness, which can be used for malicious client‑side attacks without requiring elevated server permissions.

The affected product is SourceCodester Sales and Inventory System, version 1.0. No other versions or modules are listed as vulnerable.

The CVSS metric is not provided, but the flaw allows remote exploitation via a simple crafted URL, making it highly likely to be used in the wild. No EPSS score or KEV listing is available, suggesting the vulnerability may be relatively new or underreported. The lack of an official patch means this issue remains exploitable until a fix is released or mitigated by the customer.