The vulnerability is a reflected Cross‑Site Scripting flaw that permits an attacker to inject malicious script or HTML by manipulating the 'limit' parameter in the view_customers.php page. When a victim opens a URL containing the crafted value, the injected code runs within the victim’s browser session, potentially enabling session hijacking, data theft, or defacement. The weakness is a failure to properly validate and encode user input before rendering, corresponding to the Cross‑Site Scripting category.

The flaw affects the Sales and Inventory System version 1.0, as identified by the provided product information. No other vendors or product versions are disclosed, so remediation efforts should focus on any installations of this specific edition.

A CVSS base score of 6.1 indicates moderate severity; the EPSS probability of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a victim to click a malicious link, making the attack client‑side and dependent on user interaction. If successful, the injected script operates within the victim’s browser context and could compromise any data or operations authorized to that session.