The vulnerability allows an authenticated user to store arbitrary JavaScript or HTML in the database by submitting malicious content through the "website" input in a POST request. When the store details page is later accessed, the unsanitized data is rendered, causing the script to run in the victim’s browser. This can lead to defacement, credential theft, or other browser‑based attacks.

The vulnerable product is the SourceCodester Sales and Inventory System, version 1.0. No other vendor or version details are published.

The base score of 6.1 indicates medium severity. Exploit probability is low, reflected by an EPSS below 1%, and the flaw is not listed among known exploited vulnerabilities. Because the attacker must first be authenticated, exposure is limited to compromised accounts, but any user who views the affected page would have the malicious payload executed, potentially affecting many users.