A reflected cross‑site scripting flaw exists in the view_stock_availability.php component of the inventory management application. An attacker can supply a specially crafted limit value in the request URL, causing the application to echo the value back to the browser without any encoding or validation. The injected payload can execute arbitrary JavaScript in the context of any user who visits the URL, potentially stealing session cookies, defacing the site, or facilitating further attacks against authenticated users.

The vulnerability affects SourceCodester Inventory System version 1.0. No other vendors or products are listed as impacted.

The fault relies solely on external input and requires no authentication, making it reachable over the public network. The CVSS score is not provided in the data, and no EPSS indication is available, so the exact probability of exploitation remains unclear. Because the attack vector is remote and the impact involves client‑side code execution, organizations should treat this flaw as high risk unless mitigated by a patch or a proper input‑sanitization measure. The vulnerability is not recorded in the CISA KEV list, suggesting no known public exploits yet.