This vulnerability involves a cross-site scripting issue in SourceCodester Pharmacy Sales and Inventory System 1.0, specifically in the /index.php?page=types endpoint. By manipulating the ID parameter, an attacker can inject malicious scripts that execute in the context of a victim's browser. The attack vector is network-based with no privileges required, but user interaction is necessary. The vulnerability has a CVSS 4.0 score of 5.3, reflecting moderate impact and exploitability. No vendor-provided fix or mitigation details are available at this time.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction and does not grant direct system access or privilege escalation. There are no confirmed active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected functionality or applying web application firewall (WAF) rules to detect and block suspicious input targeting the ID parameter. Avoid clicking on untrusted links that may exploit this vulnerability.