The reported issue resides in the create_generic_name routine of the Pharmacy Sales and Inventory System. The generic_name input is accepted without proper sanitization, causing a reflected cross‑site scripting vulnerability. A remote attacker can inject arbitrary HTML or JavaScript into the page, which is executed in the context of users who view the response. This can lead to session hijacking, cookie theft, defacement, and other forms of client‑side compromise. The weakness is identified as CWE‑79 for XSS and CWE‑94 for input‑based code execution.

The affected product is SourceCodester Pharmacy Sales and Inventory System version 1.0. No other versions or vendor variants are listed in the CVE data.

The CVSS score of 5.1 classifies the flaw as medium severity. The EPSS score is not available, limiting risk estimation, but the threat is still present because the exploit is publicly available and can be launched remotely from any network. The vulnerability is not listed in the CISA KEV catalog, yet attackers can still craft and deploy malicious payloads without intrusion. Overall, the risk is moderate but could be higher if the site is publicly accessible and receives user input without validation.