CVE-2026-78059 is a cross-site scripting vulnerability in SourceCodester Stock Management System 1.0. The flaw exists in the /php_action/printOrder.php file where the clientName and clientContact parameters are not properly sanitized, enabling an attacker to inject and execute arbitrary scripts in the context of the victim's browser. The vulnerability can be exploited remotely without authentication. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or redirection to malicious sites. The impact is limited to the scope of cross-site scripting and does not directly affect system availability or integrity beyond the web application context.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. In the meantime, applying input validation and output encoding on the clientName and clientContact parameters can help mitigate the risk. Avoiding use of the vulnerable functionality or restricting access may reduce exposure.