A weakness in the file header.php of SourceCodester Inventory System 1.0 allows an attacker to inject malicious scripts into web pages, enabling cross‑site scripting. The description indicates that the flaw can be triggered remotely and that the exploit has been made publicly available. The vulnerability does not present a denial‑of‑service or code execution impact, but it can allow attackers to hijack user sessions or steal sensitive information through the impacted pages.

SourceCodester Inventory System version 1.0 is the affected product. No other versions or vendors are listed as impacted.

The CVSS score of 5.1 places the vulnerability in the moderate severity range. The EPSS score is currently not available, so the likelihood of exploitation cannot be fully quantified, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, relying on manipulation of one or more unsanitized parameters in header.php. If the exploit is successfully delivered, the attacker could execute arbitrary JavaScript in the context of a victim’s browser.