The SourceCodester Sales and Inventory System 1.0 suffers from a reflected cross‑site scripting vulnerability located in the add_stock.php file. The msg parameter is not sanitized, enabling attackers to inject arbitrary JavaScript or HTML that is rendered on the victim’s browser. A malicious link could execute code with the privileges of the user who visits it, leading to session hijacking, credential theft, or defacement. This flaw maps to CWE‑79 and carries a CVSS score of 9.3, indicating a high risk to confidentiality, integrity and availability from a client‑side execution angle.

Only the SourceCodester Sales and Inventory System version 1.0 is affected. No other vendors or product versions are listed. Users running this specific version of the software without a patch are at risk.

The vulnerability is exploitable remotely via a crafted URL that contains the malicious payload in the msg parameter. No authentication is required, and the entry point is typically accessible to all users, making the attack vector highly feasible. Although no official KEV listing or EPSS score is available, the high CVSS of 9.3 reflects the potential for significant damage if an attacker compromises a user’s browser. Administrators should consider this flaw high‑risk, especially in environments where the add_stock.php endpoint is publicly exposed.