The vulnerability lies in the edit‑profile.php file of the SourceCodester Web‑based Pharmacy Product Management System. An attacker can inject malicious scripts by manipulating the fullname argument, leading to client‑side code execution when the page is rendered. This flaw can be triggered remotely and has a publicly available exploit.

The affected system is SourceCodester's Web‑based Pharmacy Product Management System, version 1.0. No other vendors or product versions are listed.

The CVSS base score is 5.1, indicating moderate severity, and the EPSS score is less than 1 %, suggesting a low probability of exploitation. The weakness is not listed in the CISA KEV catalog, but the public exploit available means that attackers could still target systems running the vulnerable version. The attack path requires a crafted request to edit‑profile.php with a malicious fullname value, which is then reflected in the browser without proper sanitization.