This vulnerability involves a cross-site scripting issue in the SourceCodester Indian Invoicing System (up to versions 0.x and 1.0). The affected component is the Invoice Template Render Database-Backed function located in /Invoicing/add_order.php. Manipulating the customer_name parameter can lead to XSS attacks, enabling remote attackers to execute arbitrary scripts in the context of the affected application. The CVSS 4.0 base score is 5.1, indicating medium severity. No official remediation or patch has been published, and the product is not a cloud service, so vendor-managed patching does not apply.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser when interacting with the affected invoicing system. This may lead to session hijacking, defacement, or other client-side attacks. The vulnerability requires low attack complexity and no privileges but does require user interaction. There is no indication of privilege escalation or direct impact on the server or data confidentiality/integrity beyond the XSS scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor the vendor's communications for updates. In the meantime, consider applying input validation or output encoding on the customer_name parameter if possible as a temporary measure to reduce risk.