This vulnerability involves a cross-site scripting issue in the Vehicle Showroom Management System 1.0 by code-projects. Specifically, the BRANCH_ID parameter in the /BranchManagement/ProfitAndLossReport.php file is not properly sanitized, allowing an attacker to inject and execute arbitrary scripts in the context of the victim's browser. The vulnerability can be triggered remotely without privileges and requires user interaction. The CVSS 4.0 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. No official remediation or patch is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or other client-side impacts. However, the impact is limited by the requirement for user interaction and the absence of elevated privileges needed to exploit the flaw. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and output encoding on the BRANCH_ID parameter as a temporary mitigation. Additionally, educating users to avoid clicking suspicious links related to this parameter can reduce risk. Monitor vendor channels for updates and apply official patches once released.