The vulnerability resides in the create_medicine_presentation function of the Pharmacy Sales and Inventory System. By manipulating the medicine_presentation parameter, an attacker can inject arbitrary JavaScript that will be reflected when the page is rendered. This flaw is an instance of Cross‑Site Scripting (CWE‑79) and is categorized as medium severity due to its potential to compromise user confidentiality, integrity and availability.

The affected product is SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw was identified in that release of the create_medicine_presentation module and is listed in the CNA data as impacted.

The CVSS base score of 5.1 indicates moderate severity, while the EPSS score is not available, offering no additional data on exploit likelihood. The issue can be triggered remotely by sending a crafted request to the application’s create_medicine_presentation endpoint. Because the code executes user‑supplied input without proper encoding, attackers can inject persistent or reflected XSS payloads. The vulnerability is not listed in CISA’s KEV catalog, implying no known active exploits at this time, but the possibility of remote exploitation remains.