This vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote attackers to perform cross-site scripting attacks by manipulating the generic_name parameter in the create_generic_name function located at /ShowForm/create_generic_name/main. The vulnerability enables injection of malicious scripts that could be executed in the context of the affected application. The CVSS 4.0 base score is 5.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. No official fix or vendor advisory is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the requirement for user interaction and the absence of privilege escalation or direct system compromise. There are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation and output encoding on the generic_name parameter to mitigate XSS risks. Additionally, employing web application firewalls (WAFs) to detect and block malicious payloads may help reduce exposure.