The flaw resides in the User Management Module of SourceCodester Online Book Store System 1.0. An attacker can alter the Name/Username field to contain malicious script code that is stored in the database and then executed in other users’ browsers when that information is displayed. This stored cross‑site scripting vulnerability allows an attacker to inject client‑side code and, depending on user interaction, can deface pages, steal sessions, or redirect traffic. The weakness is represented by CWE‑79 (XSS) and CWE‑94 (Code Injection).

SourceCodester Online Book Store System version 1.0 is affected. The vulnerability resides in the User Management Module and impacts any installation that does not properly validate or encode the Name/Username input.

Attackers can submit malicious input through the Name/Username field remotely, and because it is stored and later rendered without proper encoding, the impact occurs when other users view that data. The CVSS score of 4.8 indicates moderate severity, and the EPSS score of <1% suggests a very low probability of exploitation. No entry exists in CISA’s KEV catalog, but a publicly available exploit can be found online. The attack requires only HTTP requests and no privileged access, which keeps the likelihood of exploitation low, though administrators should still monitor for usage.