A reflected cross‑site scripting flaw in the SourceCodester Sales and Inventory System 1.0 allows an attacker to embed arbitrary JavaScript or HTML into the view_product.php page by supplying a malicious string in the limit query parameter. When a victim follows a crafted link, the unsanitized value is echoed back into the page, enabling the embedded code to execute in the victim’s browser. This can lead to cookie theft, session hijacking, unauthorized content injection, or phishing attacks against users of the application.

The vulnerability exists in SourceCodester Sales and Inventory System version 1.0, specifically within the view_product.php script that accepts a limit parameter in its query string. Any deployment of that version that exposes the limit parameter is susceptible to exploitation.

The CVSS score of 6.1 indicates a medium severity, while the EPSS score below 1 % suggests that widespread exploitation has not yet been observed. The flaw requires only a crafted URL and does not need authentication or privileged access, making it easy for an attacker to target any user who clicks a malicious link. Although it is not listed in CISA’s KEV catalog, the lack of input validation means it remains a high priority for remediation.