This vulnerability affects SourceCodester Indian Invoicing System 1.0, specifically an unknown function in /Invoicing/category.php that processes the 'msg' parameter. Improper input validation leads to a cross-site scripting flaw, enabling remote attackers to inject and execute arbitrary scripts in the context of the victim's browser. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, partial user interaction, and limited impact on integrity. No official remediation or patch has been disclosed by the vendor as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to the client side and does not affect server confidentiality, integrity, or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding workarounds if possible. Monitor vendor channels for updates and avoid exposing the vulnerable parameter to untrusted input.