What is the CVSS score of CVE-2026-30557?

CVE-2026-30557 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-30557?

Yes, a public proof-of-concept exploit is available for CVE-2026-30557. Prioritise patching immediately. EPSS: 0.1%.

PHP CVE-2026-30557

EUVD-2026-17096 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-30 mitre

GHSA-qj64-x78v-v8w2

XSS PHP

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Apr 06, 2026 - 14:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 16:00 euvd

EUVD-2026-17096

Analysis Generated

Mar 30, 2026 - 16:00 vuln.today

CVE Published

Mar 30, 2026 - 00:00 nvd

MEDIUM 6.1

DescriptionCVE.org

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_category.php file via the "msg" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.

AnalysisAI

Reflected cross-site scripting (XSS) in SourceCodester Sales and Inventory System 1.0 allows remote attackers to inject arbitrary JavaScript or HTML through an unsanitized 'msg' parameter in add_category.php, enabling session hijacking, credential theft, or malware distribution via malicious URLs. Publicly available exploit code exists, increasing real-world attack likelihood despite the absence of formal CVSS scoring or CVE severity data.

Technical ContextAI

The vulnerability stems from improper input validation in a PHP-based web application. The add_category.php file accepts user-supplied input via the 'msg' parameter without sanitizing or encoding the output before reflecting it back to the client browser. This classic reflected XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) allows attackers to inject malicious scripts that execute in the victim's browser context. The vulnerable parameter is passed directly into the HTTP response, enabling script injection when the URL is visited or clicked by a user. SourceCodester's inventory management system is a common open-source PHP application used in small-to-medium retail environments, making it a practical target for mass exploitation campaigns.

RemediationAI

Immediate remediation requires upgrading to a patched version if available from SourceCodester, or applying input sanitization patches directly. Developers must implement output encoding (HTML entity encoding via htmlspecialchars() or htmlentities() in PHP) on all instances where user input is reflected back to the browser, specifically the 'msg' parameter in add_category.php. Additionally, implement Content Security Policy (CSP) headers to restrict inline script execution, and apply input validation to reject or strip potentially malicious characters. If vendor patches are unavailable, apply a Web Application Firewall (WAF) rule to block requests containing suspicious script patterns in the 'msg' parameter as a temporary control. Review the public exploit code available at https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-AddCategory-msg.md to understand the exact injection vector and test remediation effectiveness.