The vulnerability is a reflected XSS that occurs when the application accepts an unsanitized value for the ‘limit’ parameter in view_stock_availability.php. Attackers can send a crafted URL that includes malicious JavaScript or HTML, which is then rendered in the victim’s browser. This flaw allows execution of arbitrary client‑side code, enabling session hijacking, defacement, or phishing, and corresponds to CWE‑79.

The affected system is the SourceCodester Sales and Inventory System 1.0, specifically the module that processes the limit query variable. The public CPE identifies the product as inventory_system version 1.0. No alternative vendors or versions are listed, so any deployment matching that version is potentially vulnerable.

The overall risk is moderate with a CVSS composition indicating that the issue can be triggered remotely without authentication. The EPSS figure suggests that few attacks are expected to target this flaw at present, and it is not yet in the known‑exploited list. Nevertheless, because the vulnerability requires only a malicious link, users browsing the system may have their browsers compromised, so a high‑priority patch or mitigation should be applied.