This vulnerability involves a cross-site scripting (XSS) issue in SourceCodester Pharmacy Sales and Inventory System 1.0. Specifically, the vulnerability is triggered by manipulating the ID parameter in the /index.php?page=product endpoint. This allows an attacker to inject malicious scripts that execute in the context of the victim's browser. The vulnerability is remotely exploitable and the exploit has been publicly released. There is no vendor-provided patch or official remediation at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser session when visiting the affected page. This may lead to theft of session cookies, defacement, or other client-side attacks. However, the CVSS score of 4.8 and the medium severity rating indicate that the impact is limited compared to more severe vulnerabilities. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the ID parameter to mitigate the risk of XSS. Additionally, employing web application firewalls (WAFs) that detect and block XSS payloads may reduce exposure. Monitor vendor channels for updates regarding patches or official mitigations.