CVE-2026-30561 is a reflected XSS vulnerability in SourceCodester Sales and Inventory System 1.0. The issue arises because the add_purchase.php script does not properly sanitize the "msg" parameter, enabling attackers to inject malicious scripts via crafted URLs. This vulnerability can be exploited remotely without authentication but requires user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation can allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure or manipulation of displayed content. There is no impact on system availability. The scope change indicates that the vulnerability affects resources beyond the vulnerable component, but the impact remains limited to confidentiality and integrity.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, users should avoid clicking on untrusted links that might exploit this vulnerability. Implementing proper input validation and output encoding on the "msg" parameter would mitigate the issue once a fix is available.