This vulnerability allows remote attackers to execute cross-site scripting attacks by manipulating the company_name parameter in the create_supplier function of SourceCodester Pharmacy Sales and Inventory System 1.0. The issue is due to insufficient input sanitization or output encoding in the affected function, enabling injection of malicious scripts that can be executed in the context of the victim's browser. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation can lead to execution of arbitrary scripts in the context of users interacting with the vulnerable function, potentially resulting in session hijacking, defacement, or other client-side impacts. There is no indication of direct impact on system integrity or availability. The exploit is publicly available, increasing the risk of attacks.

No official patch or remediation is currently available. Users should monitor the vendor's advisory for updates. Until a fix is released, consider applying input validation and output encoding on the company_name parameter as a temporary mitigation. Avoid exposing the vulnerable functionality to untrusted users if possible.