A stored cross‑site scripting flaw exists in the Simple Customer Relationship Management System. The flaw arises when an attacker supplies a malicious payload in the Description field on the create‑ticket.php page. Because the application stores the input without proper filtering, the payload is rendered in future ticket views, allowing the attacker to execute arbitrary scripts in the browsers of users who view the ticket. This can lead to session hijacking, defacement, or other client‑side attacks.

The vulnerability is present in SourceCodester Simple Customer Relationship Management System version 1.0, affecting the Create Ticket component. No other versions or products are listed in the advisory.

The CVSS score of 5.1 indicates a moderate severity. EPSS is not available, and the issue is not listed in CISA’s KEV. Exploitation is remote; an attacker merely needs to trigger the vulnerable input via the web interface. No special privileges are required. Because the flaw is stored, any user who views the affected ticket can be compromised.