This vulnerability involves improper input sanitization in the 'limit' parameter of the view_product.php file in SourceCodester Sales and Inventory System 1.0. An attacker can craft a URL that injects malicious scripts, leading to reflected Cross-Site Scripting (CWE-79). The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. No known exploits have been reported, and the affected version is SourceCodester Sales and Inventory System 1.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider applying input validation or sanitization controls on the 'limit' parameter at the application or web server level. Additionally, employing Content Security Policy (CSP) headers may help mitigate the impact of reflected XSS attacks.