The vulnerability is a reflected XSS located in view_sales.php, triggered by the limit parameter. The application does not encode or validate this input, allowing attackers to embed arbitrary JavaScript or HTML in a crafted URL. When a victim clicks such a URL, the malicious code runs in the victim’s browser with the privileges of the logged‑in user, potentially stealing session cookies, conducting defacement, or redirecting the user to phishing sites. The weakness corresponds to CWE‑79 and can compromise confidentiality, integrity, and availability of user data.

The affected software is SourceCodester Sales and Inventory System version 1.0. No other vendors or versions are listed in the CNA data, so only this release is known to be vulnerable.

The CVSS score of 6.1 marks this issue as medium severity, while the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not in the CISA KEV catalog, indicating it has not yet been widely exploited in the wild. An attacker would need to lure a user to a specially crafted URL containing an unsafe limit value, which is a classic reflected XSS attack vector. Since the flaw stems from missing input sanitization, it can be exploited with minimal technical skill, but it requires user interaction to trigger the payload.