An input parameter named BRANCH_ID in the ProfitAndLossReport.php file can be manipulated to inject malicious code. This flaw allows an attacker to run arbitrary scripts when the page is viewed, potentially stealing session data or injecting malware. The vulnerability is a typical reflected XSS problem identified under CWE‑79, which can undermine confidentiality and integrity of the web application.

The affected product is code‑projects Vehicle Showroom Management System version 1.0. The vulnerability resides in an unspecified function of the file /BranchManagement/ProfitAndLossReport.php, and can be triggered from any user who can access that page with a crafted BRANCH_ID value.

The CVSS score of 5.3 indicates a moderate risk. There is no EPSS data and the vulnerability is not listed in CISA’s KEV catalog, but the exploit has been made public and is noted as usable remotely. Attackers can reach the vulnerable endpoint over the network and supply a malicious BRANCH_ID value to inject script payloads that run in the victim’s browser.