The flaw resides in the create_medicine_name routine of the Pharmacy Sales and Inventory System, where an attacker can control the medicine_name argument. By supplying malicious script payloads, the vulnerable code reflected the input without proper encoding, resulting in a stored or reflected cross‑site scripting vulnerability. An attacker could, for example, inject JavaScript that steals session cookies, defaces the interface, or redirects users to phishing sites. The weakness is typical of CWE‑79 (XSS) and exploits improper input validation.

Only version 1.0 of SourceCodester Pharmacy Sales and Inventory System is known to be affected. The system is delivered by SourceCodester and is used in pharmacies to manage drug inventory and sales.

The CVSS score of 5.1 indicates a moderate severity. No EPSS value was reported, and the flaw is not listed in CISA’s KEV catalog, yet the vulnerability is publicly exploitable via a remote HTTP request to the create_medicine_name endpoint. No authentication is required; any user able to access the form can trigger the payload. Because the flaw relies on user input, attackers may craft malicious requests without needing privileged credentials.