The Vehicle Showroom Management System version 1.0 contains a cross-site scripting vulnerability in the /BranchManagement/ServiceAndSalesReport.php file. Specifically, the BRANCH_ID parameter is not properly sanitized, enabling an attacker to inject and execute arbitrary scripts in the context of the victim's browser. The vulnerability is remotely exploitable without authentication and requires user interaction to trigger. The CVSS 4.0 base score is 5.3, indicating a medium severity level. No official fix or patch has been published by the vendor as of the data provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users interacting with the affected system. This may lead to session hijacking, defacement, or other client-side attacks. However, the attack requires user interaction and does not grant direct system access or privilege escalation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the BRANCH_ID parameter as a temporary mitigation. Additionally, educating users to avoid clicking suspicious links may reduce risk. Monitor vendor channels for updates regarding an official patch or workaround.