A reflected cross‑site scripting flaw exists in the view_category.php page of SourceCodester Sales and Inventory System 1.0. An attacker can supply a specially crafted value for the limit parameter that is reflected back in the response without proper encoding, allowing the injection of arbitrary JavaScript or HTML. If executed in the victim’s browser, the script can steal session cookies, deface pages, or redirect users to malicious sites.

The vulnerability affects SourceCodester Sales and Inventory System 1.0, specifically the view_category.php component that handles the limit query parameter. The CPE indicates version 1.0 of the application and no higher, patching of which should eliminate the flaw.

The CVSS score of 6.1 places this issue in the medium severity range, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is through a remotely crafted URL that supplies the malicious limit value to the vulnerable page.