This vulnerability involves a cross-site scripting issue in the Vehicle Showroom Management System 1.0 by code-projects. Specifically, the BRANCH_ID parameter in the /BranchManagement/ProfitAndLossReport.php file is not properly sanitized, allowing an attacker to inject malicious scripts. The attack vector is network-based with low attack complexity and no privileges required, but user interaction is necessary. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official fix or patch has been published as of the data provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the requirement for user interaction and the absence of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the BRANCH_ID parameter as a temporary mitigation. Monitor vendor channels for updates regarding patches or official remediation.