CVE-2026-30570 describes a reflected XSS vulnerability in SourceCodester Sales and Inventory System 1.0. The vulnerability arises because the "limit" parameter in the view_sales.php file does not properly sanitize user input, enabling attackers to inject malicious scripts or HTML via crafted URLs. This can lead to partial confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L/A:N). The vulnerability requires no privileges and can be triggered by user interaction (UI:R).

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to information disclosure or manipulation of displayed content. The CVSS score of 6.1 reflects a medium impact with limited confidentiality and integrity loss but no impact on availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or sanitization on the "limit" parameter to prevent injection of malicious scripts. Additionally, applying web application firewalls (WAF) rules to detect and block reflected XSS attempts may help mitigate risk.