This vulnerability in SourceCodester Inventory System 1.0 involves a cross-site scripting flaw in the User Management Page (/users.php). The issue is triggered by manipulating the fullname or username arguments, which are not properly sanitized, enabling remote attackers to execute arbitrary scripts in the context of the affected application. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official remediation or patch is currently documented, and the product is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser when interacting with the User Management Page, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the medium severity rating and the requirement for user interaction (UI:P). There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding workarounds on the fullname and username parameters if possible. Monitoring for updates from SourceCodester is recommended.