A reflected Cross‑Site Scripting flaw resides in the add_category.php file of the SourceCodester Sales and Inventory System 1.0, where the "msg" query parameter is not sanitized. An attacker can inject arbitrary HTML or JavaScript by crafting a URL that contains malicious payloads in this parameter. If a legitimate user follows such a link, the injected script runs in the user’s browser, potentially allowing cookie theft, session hijacking, or malicious redirects. The weakness is consistent with CWE‑79, which describes reflected XSS injection. The impact on confidentiality, integrity, or availability is limited to the victim’s browser session and does not compromise server‑side data directly.

The vulnerability affects exclusively the SourceCodester Sales and Inventory System version 1.0, as identified by the provided CPE string. No other vendors, products, or versions are listed in the CNA data for this CVE.

The CVSS base score of 6.1 indicates a moderate risk level. The EPSS score of less than 1% suggests that the likelihood of widespread exploitation is low, and the vulnerability is not currently catalogued in CISA’s KEV list. Exploitation requires only that a user visit a tailored URL containing the malicious "msg" parameter; no authentication or privileged access is required. The attack is achievable via a standard web browser and can be performed by anyone who can send or entice a target to click the crafted link.