Technical impact
A reflected cross‑site scripting vulnerability was discovered in SourceCodester Inventory Management System 1.0, specifically in an unknown function of the file /api/customers_handler.php. Manipulation of the Customer_Name argument allows injection of arbitrary script that executes in the victim’s browser context. The flaw is exploitable from a remote location via an HTTP request and has already been disclosed publicly.
Affected Systems
The affected product is SourceCodester Inventory Management System® version 1.0, as listed by the CNA under the vendor SourceCodester in the CNA data.
Risk and Exploitability
The CVSS score of 5.1 classifies the issue as moderate severity. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers could feasibly exploit the flaw over the network by sending a crafted request containing malicious input, which would result in the victim’s browser executing script. Because no official patch or workaround is documented, the risk remains contingent on the vendor’s response.
