VulnerabilityAnalyzed
CVE-2026-30556
A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0.
MEDIUM 6.1EPSS 0.25%
Does this matter?
Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.
Description
A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the index.php file via the "msg" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.25% probability · 17th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- ahsanriaz26gmailcom/sales and inventory system
- Source
- cve@mitre.org
References
- https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-Index-msg.mdExploit, Third Party Advisory
- https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-Index-msg.mdExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.