A vulnerability exists in the Pharmacy Sales and Inventory System that allows an attacker to inject malicious script payloads into the Name field used by the /index.php?page=users endpoint. The flaw can lead to client‑side execution of arbitrary code when a user views the affected page, potentially enabling credential theft, defacement, or further exploitation from the victim’s browser. The weakness is an input validation flaw (CWE‑79) coupled with an untrusted eval usage (CWE‑94).

SourceCodester Pharmacy Sales and Inventory System version 1.0 is vulnerable through the index.php page handling the users module. No other versions or products are currently documented as affected.

The CVSS base score of 4.8 denotes moderate severity, and the lack of an EPSS value implies no publicly confirmed exploit prevalence. The vulnerability is not present in the CISA KEV catalog. An attacker can trigger the flaw remotely by crafting a request to /index.php?page=users with a malicious Name parameter, then persuading or tricking an authenticated or public user to view the response. The impact is limited to client browsers; an isolation of the vulnerability to the user interface reduces system‑wide compromise unless the user follows advanced stages of an XSS chain.