A reflected cross‑site scripting vulnerability was discovered in the view_payments.php file of SourceCodester Sales and Inventory System 1.0, where the application does not sanitize the "limit" parameter. The flaw allows a remote attacker to inject arbitrary web script or HTML through a crafted URL. None of the public documentation details the exact outcomes; based on the nature of XSS, an attacker can potentially run code in the victim’s browser, which may then be used to steal credentials, modify page content, or redirect users to malicious sites. The weakness is classified as CWE‑79.

SourceCodester Sales and Inventory System version 1.0 is affected.

The CVSS score of 6.1 places the vulnerability in the moderate range. No EPSS score is provided and the issue is not listed in the CISA KEV catalog, indicating no widespread exploitation data. The likely attack vector is aligned with reflected XSS: a victim must be induced to visit a maliciously constructed link, which can occur via phishing or malicious advertising. The exploit conditions are relatively low, requiring only the delivery of a crafted URL to an aware user; the impact is limited to the victim’s browser context.