A reflected Cross‑Site Scripting flaw exists in SourceCodester Inventory System 1.0. An attacker can embed arbitrary JavaScript or HTML into the "limit" URL parameter of the view_purchase.php page, causing it to execute in the victim’s browser. This client‑side script execution can lead to session hijacking, data theft, defacement, or other malicious actions performed under the privileges of the compromised user.

The vulnerability is present in SourceCodester Inventory System version 1.0. No additional version details are provided, and the flaw resides specifically in the view_purchase.php component of this application.

No CVSS or EPSS score is available, but the nature of a reflected XSS indicates high potential impact when a user visits a crafted URL. The attack route is remote and requires only user interaction with the malicious link; it becomes more dangerous if the user is authenticated or follows trust assumptions. The vulnerability is not listed in the CISA KEV catalog, and no public exploitation evidence is documented in the provided references.