A stored cross‑site scripting flaw exists in the update_details.php module of the SourceCodester Sales and Inventory System version 1.0. The application does not sanitize the website field supplied through a POST request. This omission allows an authenticated user to embed arbitrary JavaScript or HTML, which is saved to the database and rendered when the store details page is accessed. The injected code runs in the browsers of any visitor viewing that page, enabling malicious scripts to execute in the context of the application.

SourceCodester Sales and Inventory System 1.0 is affected. The vulnerability arises when a user with permission to update store details submits a request to update_details.php. No other versions or products are listed as affected.

With a CVSS score of 6.1 the flaw carries medium severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires a legitimate authenticated session possessing update rights. Once authenticated, an attacker can inject and store malicious script via the website field, which will then be executed in any browser that opens the store details page. This elevates the risk of unintended script execution for site visitors, although it does not provide a direct privilege escalation or data breach vector.