A reflected cross‑site scripting vulnerability was discovered in SourceCodester Inventory Management System 1.0, specifically in an unknown function of the file /api/customers_handler.php. Manipulation of the Customer_Name argument allows injection of arbitrary script that executes in the victim’s browser context. The flaw is exploitable from a remote location via an HTTP request and has already been disclosed publicly.

The affected product is SourceCodester Inventory Management System® version 1.0, as listed by the CNA under the vendor SourceCodester in the CNA data.

The CVSS score of 5.1 classifies the issue as moderate severity. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers could feasibly exploit the flaw over the network by sending a crafted request containing malicious input, which would result in the victim’s browser executing script. Because no official patch or workaround is documented, the risk remains contingent on the vendor’s response.