This vulnerability involves a cross-site scripting flaw in SourceCodester Pharmacy Sales and Inventory System 1.0. Specifically, the Customer function in the /index.php?page=customer file improperly handles the Name parameter, allowing an attacker to inject malicious scripts. The attack vector is network-based, requiring low attack complexity and user interaction, with no privileges needed beyond a normal user. The vulnerability does not involve confidentiality, integrity, or availability impacts beyond the XSS effect. No official fix or patch has been documented as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application for users who interact with the vulnerable parameter. This may lead to session hijacking, defacement, or other client-side attacks. However, the impact is limited to the scope of the XSS and does not directly compromise server confidentiality, integrity, or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the Name parameter to mitigate the risk. Additionally, employing web application firewalls (WAFs) that detect and block XSS payloads may reduce exposure.