The vulnerability permits reflected cross‑Site Scripting through manipulation of the ID parameter in /index.php?page=types. An attacker can embed malicious JavaScript directly in the URL; the application echoes the value in the page without sanitization. When a user visits the crafted link, the script runs in the victim’s browser, enabling data theft, session hijacking, or defacement. This flaw is client‑side and does not grant remote code execution on the server.

SourceCodester Pharmacy Sales and Inventory System 1.0, running on an unspecified platform.

The CVSS score of 5.3 indicates medium severity. EPSS information is not available, and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog. The flaw can be triggered remotely via a typical HTTP GET request; the attacker only needs to supply a malicious ID string. An exploit remains publicly available, so the risk of exploitation is considered low to moderate.