CVE-2026-78060 is a cross-site scripting vulnerability affecting SourceCodester Stock Management System version 1.0. The issue is due to insufficient input validation or sanitization of the clientName and clientContact parameters in the /php_action/getOrderReport.php endpoint. An attacker can remotely exploit this flaw by manipulating these parameters to execute arbitrary scripts in the context of the victim's browser. The vulnerability has been publicly disclosed, but no official fix or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users interacting with the affected endpoint, potentially leading to session hijacking, defacement, or other client-side attacks. However, the vulnerability does not require privileges or user interaction beyond visiting a crafted URL, and the impact is limited to client-side script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and output encoding on the affected parameters as a temporary mitigation. Additionally, applying web application firewalls (WAF) rules to detect and block malicious input targeting these parameters may reduce risk.