CVE-2026-30556

MEDIUM

SourceCodester Sales and Inventory System 1.0 - XSS

Title source: llm

Description

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the index.php file via the "msg" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.

References (1)

https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-Index-msg.md

View Exploit ZIP pw:eip

Scores

CVSS v3 6.1

EPSS 0.0001

EPSS Percentile 1.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

ahsanriaz26gmailcom/sales_and_inventory_system 1.0

n/a/n/a

Published Mar 30, 2026

Tracked Since Mar 30, 2026