A reflected cross‑site scripting flaw exists in the sales component of the SourceCodester Sales and Inventory System. An attacker can craft a URL containing malicious JavaScript or HTML in the msg parameter, which the system echoes back to the browser without proper encoding or sanitization. When a user visits the link, the injected code runs in the victim’s browser, allowing the attacker to steal session cookies, deface the page, or inject further malicious payloads.

The vulnerability affects the SourceCodester Sales and Inventory System, specifically the add_sales.php component in version 1.0.

The attack vector is a simple HTTP request to the add_sales.php page with a user‑controlled msg parameter, and no authentication is required to trigger it. Because the flaw is readily exploitable through a crafted link, the risk to any user who follows such a link is high. No CVSS score is provided, but the scenario aligns with typical reflected XSS severity, providing a tool for attackers to harvest credentials or manipulate user data. The EPSS score is unavailable and the issue is not in the CISA KEV catalog. Nonetheless, the potential impact on confidentiality, integrity, and availability of the application’s users is significant.