The SourceCodester Inventory System 1.0 contains a vulnerability that allows an attacker to inject arbitrary JavaScript by supplying malicious content in the Product_Name, Product_Code, or Vendor_Name fields during the save_purchase action. This form of cross‑site scripting enables the attacker to execute code within the browser of any user who later views the affected purchase record, potentially leading to credential theft, session hijacking, or defacement. The impact is confined to client‑side code execution and does not directly modify or disclose server‑side data.

The vulnerability applies specifically to SourceCodester Inventory System 1.0 as released on the SourceCodester website. It is triggered via the /api/transactions_handler.php endpoint when performing the action=save_purchase operation. No other product versions have been identified as affected, and the vendor has not issued a fixed release at the time of this report.

The CVSS score of 5.1 places the flaw in the medium severity range, and the EPSS score is currently unavailable. The flaw is publicly disclosed and can be triggered remotely by crafting an HTTP request to the vulnerable endpoint, meaning an attacker does not need prior authentication or network access. Although the vulnerability is not listed in the CISA KEV catalog, the public availability of the exploit and the ease of triggering it from outside the network make it a moderate risk that should be addressed promptly.