This vulnerability allows an attacker to inject malicious scripts via the 'Name' parameter in the /index.php?page=users page of SourceCodester Pharmacy Sales and Inventory System 1.0. Successful exploitation results in cross-site scripting, potentially enabling attackers to execute arbitrary scripts in the context of the affected application. The vulnerability is remotely exploitable and an exploit has been published. There is no vendor-provided patch or official remediation level indicated at this time.

Exploitation of this vulnerability can lead to the execution of arbitrary scripts in the user's browser, which may result in session hijacking, defacement, or other client-side attacks. The CVSS score of 4.8 reflects a medium impact level. There is no indication of privilege escalation or server-side compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying web application firewall (WAF) rules to detect and block XSS attempts targeting the 'Name' parameter on the affected page. Additionally, input validation and output encoding should be reviewed and strengthened if possible.