CVE-2026-30561

CVE-2026-30561 is a reflected XSS in SourceCodester Sales and Inventory System 1.0, triggered in add_purchase.php via the msg parameter. The input is not properly sanitized, allowing an attacker to craft a URL that injects arbitrary script/HTML when viewed by a victim. The connected documents con...