A reflected cross‑site scripting vulnerability exists in the SourceCodester Inventory System 1.0, located in the view_product.php file via the ‘limit’ query parameter. The application fails to sanitize the input, allowing a remote attacker to construct a URL that injects malicious JavaScript or HTML. When a user opens the crafted link, the injected code runs in the context of the website, which could lead to defacement, credential theft, or session hijacking.

The affected product is the SourceCodester Inventory System, version 1.0, implemented in PHP. The flaw resides in the view_product.php script that processes the ‘limit’ parameter. No other versions or deployments are documented as vulnerable in the provided material.

The flaw allows remote exploitation without authentication. Any user who clicks the malicious link is at risk, as the attacker can inject arbitrary client‑side code. Although no CVSS score is supplied, reflected XSS vulnerabilities are typically considered high severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, but the potential for widespread exploitation remains because the trigger requires only a visit to a crafted URL.