This vulnerability involves improper input validation of the 'ID' parameter in the /delete.php component of SourceCodester Sales and Inventory System 1.0. An attacker can manipulate this parameter to execute cross-site scripting attacks remotely. The CVSS 4.0 base score is 5.1, reflecting medium severity with network attack vector, low attack complexity, no privileges required, and partial user interaction needed. No official fix or patch has been disclosed by the vendor, and the product is not a cloud service.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction and low privileges but can be triggered remotely via crafted URL parameters. There is no indication of privilege escalation or server-side compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and output encoding on the 'ID' parameter in /delete.php as a temporary mitigation. Additionally, educating users to avoid clicking suspicious links related to this application may reduce risk.