CVE-2026-30557 - Vulnerability Analysis

Overview

SourceCodester Sales and Inventory System 1.0 contains a reflected XSS caused by unsanitized input in the "msg" parameter of add_category.php, letting remote attackers inject arbitrary web scripts via crafted URLs.

Severity & Score

Impact

Remote attackers can execute arbitrary scripts in users' browsers, potentially stealing cookies or performing actions on behalf of users.

Mitigation

Update to the latest version with proper input sanitization or apply patches to sanitize the "msg" parameter.

References

• https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-AddCategory-msg.md

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner