This vulnerability is a Reflected Cross‑Site Scripting flaw located in the view_purchase.php file of SourceCodester Sales and Inventory System 1.0. The application accepts a 'limit' query parameter without sanitizing it, so a crafted URL can inject arbitrary JavaScript or HTML. A remote attacker can trigger the execution of the injected script in the victim's browser. The impact of this flaw is that an attacker can perform actions such as stealing session cookies, defacing the site, or injecting malware, thereby compromising the confidentiality and integrity of user data. The weakness is an instance of CWE‑79: Improper Neutralization of Input During Web Page Generation.

The affected system is the SourceCodester Sales and Inventory System, version 1.0. No other vendors or versions are listed in the vulnerability data. The flaw resides in the view_purchase module, which is built on PHP and serves publicly accessible purchase list pages.

The CVSS score of 4.8 indicates moderate severity, while an EPSS score of <1% shows that current exploit prevalence is very low. The flaw is not listed in the CISA KEV catalog. Attackers would need to entice a user to visit a malicious URL containing a malicious 'limit' parameter; no authentication or privileged access is required. Exploitation is straightforward for someone with knowledge of XSS techniques, but environmental constraints such as additional input filtering could mitigate risk.