This vulnerability allows an attacker to perform cross-site scripting by injecting malicious input into the company_name parameter of the create_supplier function in SourceCodester Pharmacy Sales and Inventory System 1.0. The vulnerability is remotely exploitable without requiring elevated privileges and involves insufficient input sanitization or output encoding, enabling script injection. The CVSS 4.0 base score is 5.1, indicating medium severity. No vendor-provided patch or official remediation is currently documented.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the medium severity rating and the requirement for user interaction (UI:P). There is no indication of privilege escalation or server-side compromise from the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding workarounds on the company_name parameter to mitigate XSS risks. Monitoring for updates from SourceCodester is recommended.