CVE-2026-78060: SourceCodester Stock Management System getOrderReport.php cross site scripting
A vulnerability was found in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /phpaction/getOrderReport.php. Performing a manipulation of the argument clientName/clientContact results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and does not require privileges. However, exploitation requires user interaction, meaning a user must be induced to access or process attacker-controlled input.
Which inputs and endpoint should be investigated?
The affected processing is in /php_action/getOrderReport.php. The clientName and clientContact arguments are the identified injection points and should be reviewed for unescaped output.
Is public exploit information available?
Yes. The exploit has been made public, which increases the likelihood of attempted exploitation.