The vulnerability arises from insufficient sanitization of the Hsn_Code argument in a sales transaction handler. When an attacker supplies crafted input, the value is reflected or stored without proper encoding, enabling the injection of malicious scripts. If an attacker succeeds, they can execute code in the context of a victim’s browser session, potentially hijacking cookies, defacing the interface, or exfiltrating sensitive data. This is a classic cross‑site scripting flaw (CWE‑79) that can be abused when the application renders the value of Hsn_Code in a response page.

SourceCodester Inventory System, version 1.0, is affected. The issue is present in the component that handles the save_sale action via the API endpoint /api/transactions_handler.php. No other versions or product lines are listed as vulnerable in the provided data.

The CVSS score of 5.1 indicates a moderate risk level, and the EPSS score is not available, so the likelihood of exploitation is unknown. The vulnerability is not included in the CISA KEV catalog. The attack requires remote interaction with the web application and the ability to supply a custom Hsn_Code parameter, a scenario that is typically viable for web‑based applications exposed to the internet. Given that the flaw involves user‑controlled input, the exploitation path is straightforward for an attacker with knowledge of the vulnerable endpoint.