This vulnerability affects SourceCodester Pharmacy Sales and Inventory System 1.0. It arises from improper handling of the medicine_name parameter in the create_medicine_name function, allowing an attacker to inject malicious scripts via cross-site scripting. The vulnerability is remotely exploitable and the exploit has been publicly disclosed. The CVSS 4.0 base score is 5.1, indicating medium severity. No vendor-provided patch or mitigation details are currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to the scope of the affected function and requires user interaction (UI:P). There is no indication of privilege escalation or server-side compromise from the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding on the medicine_name parameter to mitigate XSS risks. Monitoring for updates from SourceCodester is recommended.