SourceCodester Sales and Inventory System 1.0 contains a reflected XSS flaw in the add_purchase.php script where the msg parameter is echoed without filtering. An attacker can craft a URL that injects arbitrary JavaScript or HTML; when a victim clicks the link, the injected code runs in the victim’s browser context. The vulnerability allows potential theft of credentials, session hijacking, or site defacement. Based on the description, it is inferred that no authentication is required to reach the vulnerable endpoint, making exploitation trivial for unauthenticated users.

The only affected version identified is SourceCodester Sales and Inventory System 1.0. The add_purchase.php endpoint is exposed to all users that can access the front‑end, and no other product versions are known to be impacted. No vendor CNA information is available for this release.

The exploit is remotely triggered via a crafted URL and does not require additional privileges. No EPSS score is publicly available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw rests on lack of input validation, attackers can easily inject malicious payloads from any remote host. The risk includes compromise of user accounts, data exfiltration, and potential system disruption, with a high likelihood of exploitation due to its simplicity.