This vulnerability in SourceCodester Inventory Management System 1.0 allows an attacker to perform cross-site scripting via manipulation of an unknown functionality in the /api/vendors_handler.php file related to Vendor Management. The attack vector is network-based with low attack complexity and requires some user interaction. The vulnerability does not require elevated privileges and does not impact confidentiality or availability. The CVSS 4.0 base score is 5.1 (medium severity). Public exploit code is available but no known active exploitation in the wild has been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking or other client-side impacts. The vulnerability does not affect system confidentiality, integrity, or availability directly. The attack requires user interaction and low privileges.

No patch or official remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible.