What is the CVSS score of CVE-2026-30559?

CVE-2026-30559 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-30559?

Yes, a public proof-of-concept exploit is available for CVE-2026-30559. Prioritise patching immediately. EPSS: 0.1%.

PHP CVE-2026-30559

EUVD-2026-17098 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-30 mitre

GHSA-pj9c-w3gf-2xmg

XSS PHP

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Apr 06, 2026 - 14:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 16:00 euvd

EUVD-2026-17098

Analysis Generated

Mar 30, 2026 - 16:00 vuln.today

CVE Published

Mar 30, 2026 - 00:00 nvd

MEDIUM 6.1

DescriptionCVE.org

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in the add_sales.php file via the "msg" parameter. The application fails to sanitize the input, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL.

AnalysisAI

Reflected XSS in SourceCodester Sales and Inventory System 1.0 allows remote attackers to inject arbitrary JavaScript or HTML through the msg parameter in add_sales.php, enabling session hijacking, credential theft, or malware distribution via crafted URLs. Publicly available exploit code exists.

Technical ContextAI

The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw in a PHP-based web application. The add_sales.php endpoint accepts user input via the 'msg' parameter but fails to apply proper output encoding or input sanitization before rendering the data in HTTP responses. This allows attackers to inject malicious script tags or event handlers that execute in the victim's browser context. The root cause falls under improper neutralization of input during web page generation (CWE classification for XSS variants). The affected product is a Sales and Inventory System written in PHP, commonly deployed in small business environments for managing sales transactions and stock levels.

RemediationAI

Apply input validation and output encoding immediately. For the 'msg' parameter in add_sales.php, implement proper HTML entity encoding (using htmlspecialchars() in PHP with ENT_QUOTES flag) or context-appropriate escaping before rendering user input in HTML responses. If a patched version of SourceCodester Sales and Inventory System 1.0 is available, upgrade to it; consult the vendor or project repository (typically hosted on GitHub or similar platforms) for available updates. As a temporary workaround, implement a Content Security Policy (CSP) header to restrict script execution from inline sources. For detailed exploit analysis and proof-of-concept reference, see https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/XSS-AddSales-msg.md.