A vulnerability exists in the category.php file of SourceCodester Indian Invoicing System that allows an attacker to inject arbitrary script into the msg argument, which is rendered in the browser without proper escaping. This unchecked input leads to a classic cross‑site scripting flaw that can compromise the confidentiality, integrity, or availability of a victim’s session and may be used to hijack accounts, steal credentials, or deface the site.

SourceCodester: Indian Invoicing System version 1.0. The flaw is triggered by manipulating the msg parameter in the category.php script; no other product variants or versions were identified in the supplied information.

The CVSS score of 5.3 indicates a moderate risk, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The description notes that the attack can be initiated and that the exploit is publicly available, meaning that attackers can craft URLs or input payloads to trigger the XSS in any exposed instance of the affected system.