A content‑injection flaw exists in the Pharmacy Sales and Inventory System when the identifier parameter in the product page is manipulated. The vulnerability permits unencoded user input to be reflected in the page, enabling an attacker to inject arbitrary script that runs in the context of the victim’s browser. This can lead to credential theft, defacement, or session hijacking for the affected user. The weakness corresponds to CWE‑79 and CWE‑94, indicating improper input handling and potential code execution.

The affected product is SourceCodester Pharmacy Sales and Inventory System, version 1.0. Only the index.php file handling the page=product controller is vulnerable; no other products or versions are identified as affected.

The CVSS score of 4.8 reflects a moderate severity for an XSS vulnerability that requires only remote access to the vulnerable page. The EPSS score is not available, so the likelihood of exploitation is unclear, but public exploit code has been released, indicating the vulnerability is active. It is not listed in the CISA KEV catalog. Attackers can exploit this remotely by crafting a crafted request to /index.php?page=product with a specially‑encoded ID parameter, injecting script that retrieves user credentials or accesses other resources within the same domain.