A reflected Cross‑Site Scripting flaw in the view_customers.php component of SourceCodester Sales and Inventory System 1.0 allows a remote attacker to inject malicious JavaScript or HTML through the "limit" query parameter. When a victim visits a crafted URL, the injected payload executes in the victim's browser context, enabling session hijacking, credential theft, defacement, or other malicious actions. The flaw is listed as CWE‑79, indicating unsanitized input leading to XSS.

SourceCodester Sales and Inventory System version 1.0 is affected; the vulnerability is located in the view_customers.php file that processes the "limit" parameter. Any deployment running this specific 1.0 release and exposing the parameter is at risk; no other versions are listed as affected.

The CVSS score of 6.1 highlights moderate severity, and although EPSS data is unavailable, the simple attack vector of a crafted URL suggests a high likelihood of exploitation if users are lured to the malicious link. The vulnerability is not listed in CISA’s KEV catalog, implying no publicly known exploits yet, but the lack of input validation makes exploitation plausible and potentially damaging to confidentiality, integrity, and availability of user sessions.