Administrator session compromise via reflected limit parameter

Reflected XSS in SourceCodester Sales and Inventory System 1.0 allows remote attackers to execute script in an administrator's browser. The view_category.php page reads the GET limit pagination parameter and inserts it into the response without sanitization or output encoding. Exploitation requires a logged-in administrator to open a crafted URL; the script then runs in the application's origin and can perform actions available to that browser session.