The vulnerability is a reflected Cross‑Site Scripting flaw located in the add_purchase.php file of SourceCodester Sales and Inventory System 1.0. Attackers can embed arbitrary JavaScript or HTML in the msg query parameter, which the application outputs without escaping. This allows malicious scripts to run in the context of a victim's browser session, potentially leading to session hijacking, cookie theft, or defacement.

The flaw affects the free, open‑source Sales and Inventory System released under the SourceCodester brand, version 1.0. No official vendor or patched release is listed, so users must protect themselves until an update becomes available.

With a CVSS score of 6.1 and an EPSS under 1 %, the risk is moderate but still noteworthy. The attack vector is local to a victim who clicks a crafted URL, making it feasible for targeted phishing campaigns. Because it is not listed in CISA’s KEV catalog, there is no current evidence of widespread exploitation, yet the vulnerability remains actionable.