CVE-2026-30571 describes a reflected XSS vulnerability in SourceCodester Sales and Inventory System 1.0. The flaw is located in the view_category.php file where the "limit" parameter is not sanitized, allowing injection of malicious scripts or HTML via crafted URLs. This can lead to partial confidentiality and integrity impacts, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vulnerability requires user interaction (UI:R) and can be exploited remotely (AV:N) without privileges (PR:N).

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information and modification of data within the user's session. There is no impact on availability. The vulnerability affects confidentiality and integrity to a limited extent.

No patch or official fix information is currently available. Users and administrators should monitor the vendor's advisory channels for updates. In the meantime, applying input validation and sanitization on the "limit" parameter at the application level can help mitigate the risk. Avoid clicking on untrusted URLs that may exploit this vulnerability.