This vulnerability affects SourceCodester Simple Customer Relationship Management System 1.0, specifically in the Create Ticket component via the /create-ticket.php file. Manipulation of the Description argument leads to a cross-site scripting flaw, enabling remote attackers to execute arbitrary scripts in the context of the affected application. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability is publicly disclosed, but no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to perform cross-site scripting attacks by injecting malicious scripts through the Description parameter. This can lead to potential session hijacking, defacement, or other script-based attacks within the context of the vulnerable web application. The impact is limited to the affected application and depends on user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or sanitization on the Description parameter as a temporary mitigation. Monitor vendor channels for updates regarding an official patch or fix.