A reflected cross‑site scripting vulnerability exists in the SourceCodester Sales and Inventory System 1.0, specifically in the add_supplier.php file where the "msg" query parameter is not sanitized before being echoed back to the browser. This allows a remote attacker to supply a crafted URL that injects arbitrary web script or HTML, which the victim’s browser will execute within the context of the application, potentially enabling the attacker to run client‑side code without their Own credentials.

The affected product is the SourceCodester Sales and Inventory System, version 1.0. No other vendors or versions are listed as impacted. Deployments that run this exact version are susceptible, while later or alternative version releases may not contain the flaw.

The CVSS score of 6.1 rates the vulnerability as moderate. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the issue is not part of CISA’s KEV catalog. The attacker merely needs to lure a user to the maliciously crafted URL; no authentication or privileged access is required to trigger the flaw.