The vulnerability in SourceCodester Stock Management System 1.0 is a cross-site scripting (CWE-79) flaw located in the /php_action/getOrderReport.php endpoint. Manipulating the clientName or clientContact arguments can lead to injection of malicious scripts, which execute in the context of the victim's browser. The attack vector is remote and does not require privileges, but does require user interaction. The CVSS 3.1 base score is 4.3 (low severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on integrity only.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to limited integrity impact such as unauthorized actions performed on behalf of the user. There is no impact on confidentiality or availability. The vulnerability requires user interaction and remote access to the vulnerable endpoint.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted inputs in the affected parameters. No official fix or workaround has been published at this time.