The vulnerability is a cross‑site scripting flaw in the Product Management component of SourceCodester Inventory System. The flaw exists in the products_handler.php script, specifically the action=save endpoint, where user‑controlled parameters Product_Id and Product_Name are insufficiently sanitized. Attackers can inject arbitrary HTML or JavaScript that will be rendered in the browser of any user who views the affected page, allowing theft of session cookies or execution of code in the victim’s context (CWE‑79). The flaw is also associated with CWE‑94, indicating unsafe use of user‑supplied input in a code execution context.

SourceCodester Inventory System is the only product identified as vulnerable. The flaw exists in the API endpoint /api/products_handler.php for the action=save operation within the Product Management component. No other version ranges are listed; thus any deployment of Inventory System that includes this endpoint is affected.

The CVSS score of 5.1 indicates moderate severity, and no EPSS value is available. The vulnerability is not listed in the CISA KEV catalog, but an exploit is publicly available on GitHub and other portals, indicating that malicious actors can launch the attack from a remote location. The lack of a mitigation allows an unauthenticated attacker to inject XSS that persists for all users who load the affected page, posing a significant risk for environments with sensitive data or user activity. Remediation requires updating the product or applying a vendor patch.