A source code in the add_supplier.php script accepts a msg parameter and echoes it without encoding, permitting a remote attacker to inject malicious scripts via a crafted URL. This reflected XSS allows the attacker to run arbitrary JavaScript in the victim’s browser, deface content, steal session cookies, or redirect to phishing sites, compromising confidentiality and integrity of the web application.

SourceCodester Sales and Inventory System version 1.0

The flaw is accessible to anyone who can craft and send a request to add_supplier.php, making it remotely exploitable. While no CVSS score or EPSS data is supplied, typical reflected XSS can be triggered with a simple click on a malicious link, presenting a medium to high risk to users. No CISA KEV listing suggests no known active exploitation yet, but the absence of a patch means the issue remains open.