A reflected cross‑site scripting vulnerability is present in the view_category.php file of SourceCodester Inventory System 1.0. The application accepts a "limit" parameter from the URL without sanitizing or encoding its value, allowing attackers to inject arbitrary JavaScript or HTML. When a user follows a crafted link, the malicious code runs in the victim’s browser, potentially enabling session hijacking, credential theft, defacement, or phishing attacks. The impact is limited to the scope of the browser context but can compromise confidentiality and integrity of user data.

The affected product is SourceCodester Inventory System version 1.0. No other vendors or product variants are listed in the known CNA data.

The CVSS score and EPSS values are not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw remotely by directing a user to a URL containing a malicious "limit" value. Because the flaw is reflected, it does not require authentication or special privileges. Given the absence of mitigations on the server side, the likelihood of exploitation remains moderate to high in environments where end users regularly visit external links.