A stored Cross‑Site Scripting flaw exists in the SourceCodester Inventory System 1.0. The flaw is triggered by unsanitized handling of the fullname/username argument in the users.php file. When an attacker supplies a malicious payload in this parameter, the payload is rendered and executed in the browsers of any user who visits the affected page. This enables theft of session cookies, defacement, and execution of arbitrary client‑side code, thereby compromising the confidentiality, integrity, and availability of user data.

SourceCodester Inventory System 1.0. No other versions are listed as affected in the available data.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed remotely and public exploit code is documented, suggesting that an adversary who can craft a request containing a malicious fullname/username value can trigger the vulnerability from outside the network.