A reflected cross‑site scripting flaw exists in the view_supplier.php handler of SourceCodester Sales and Inventory System 1.0. The flaw is triggered by the unsanitized "limit" query parameter, allowing a remote attacker to embed arbitrary HTML or JavaScript through a crafted URL. Code injected through this vector can steal session cookies, hijack user sessions, deface the site, or redirect victims to malicious pages, exploiting the weakness identified as CWE‑79.

The vulnerability affects SourceCodester Sales and Inventory System version 1.0 where the view_supplier module processes the "limit" parameter. This is the only affected product noted in the advisory.

The CVSS score of 6.1 indicates moderate severity. Because exploitation requires a victim to click a malicious link, the attack vector is likely unprivileged web‑based with network access. The EPSS score is not published, and the issue is not currently listed in CISA’s KEV catalog, implying no known active exploitation. Nonetheless, given the widespread use of reflected XSS for credential theft and defacement, the risk level remains significant for exposed web applications.