CVE-2026-30560

SourceCodester Sales and Inventory System 1.0 contains a Reflected XSS in add_supplier.php through the msg parameter. The app does not sanitize input, allowing an attacker to craft a URL that injects arbitrary script/HTML. No exploitation details or patches are provided in the documents. Practica...