The flaw resides in the add_customer.php file of SourceCodester Sales and Inventory System 1.0, where the "msg" parameter is not sanitized. An attacker can place arbitrary script or HTML in that parameter and deliver it through a crafted URL, causing the victim’s browser to execute the injected code.

SourceCodester Sales and Inventory System version 1.0 is the sole affected product; no other vendors or versions are listed in the advisory.

The vulnerability has a CVSS base score of 6.1, indicating medium severity, and an EPSS score of less than 1 %, suggesting a low chance of exploitation. It is not included in the CISA KEV catalog. Based on the description, the likely attack vector involves a remote attacker crafting a malicious URL that includes a malicious msg value and luring a user to visit the link, which then results in script execution in the user’s browser.