A flaw in the Pharmacy Sales and Inventory System allows an attacker to inject and execute arbitrary client‑side script by supplying a crafted Name value to the /index.php?page=supplier endpoint. The server fails to properly sanitize or encode the input, resulting in a classic reflected cross‑site scripting vulnerability (CWE‑79). When this is triggered by a remote user, the injected code runs inside the browser context of any user who visits the affected page, giving the attacker the ability to manipulate the page or run arbitrary JavaScript.

The vulnerability is reported only for version 1.0 of SourceCodester Pharmacy Sales and Inventory System. No other versions or editions were identified as affected in the available data.

The CVSS score of 4.8 classifies the issue as moderate severity. No EPSS score is published and the flaw is not listed in CISA’s KEV catalog, indicating no confirmed exploitation to date. The entry can be reached over the public Internet via an HTTP request to /index.php?page=supplier with a specially crafted Name parameter – an entirely remote attack surface. If successfully exploited, the vulnerable code will execute on the browser of any user who loads the page, which may lead to malicious client‑side actions but no direct changes to the underlying system are described in the CVE description.