CVE-2026-78059: Cross Site Scripting in SourceCodester Stock Management System

SourceCodester Stock Management System 1.0 contains a cross-site scripting vulnerability in the /php_action/printOrder.php file. The vulnerability arises from improper sanitization of the clientName and clientContact parameters, allowing an attacker to inject and execute arbitrary scripts in the context of the victim's browser. The attack vector is remote and does not require privileges or authentication, but user interaction is necessary. The vulnerability has been publicly disclosed with exploit code available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to session hijacking, defacement, or other malicious actions performed on behalf of the user. However, the attack requires user interaction and does not grant direct system access or privilege escalation.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding on the affected parameters. Monitoring for updates from the vendor is recommended.