Description
A vulnerability was found in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /php_action/getOrderReport.php. Performing a manipulation of the argument clientName/clientContact results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Published: 2026-08-23
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability exists in the getOrderReport.php script of the SourceCodester Stock Management System. By manipulating the clientName and clientContact parameters, an attacker can cause the application to return unsanitized user input as part of the page, enabling the execution of arbitrary JavaScript on the victim’s browser. The flaw is a classic reflected XSS and is exploitable without authentication, solely through crafted HTTP requests.

Affected Systems

The affected product is SourceCodester Stock Management System version 1.0. Only the getOrderReport.php endpoint that processes the clientName and clientContact arguments is impacted. No other components are listed as vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, with no user interaction beyond sending a malicious request. The exploit has been released publicly, so attackers who discover capable clients can use it at any time.

Generated by OpenCVE AI on August 23, 2026 at 05:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SourceCodester Stock Management System to the latest available patched version.
  • Normalize user input for clientName and clientContact by applying proper output encoding or input filtering before embedding into responses.
  • Deploy a Web Application Firewall or configure a strict Content‑Security‑Policy header to mitigate the impact of any remaining reflected XSS payloads.

Generated by OpenCVE AI on August 23, 2026 at 05:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 23 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /php_action/getOrderReport.php. Performing a manipulation of the argument clientName/clientContact results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Title SourceCodester Stock Management System getOrderReport.php cross site scripting
First Time appeared Sourcecodester
Sourcecodester stock Management System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:sourcecodester:stock_management_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester stock Management System
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Stock Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-23T03:30:07.765Z

Reserved: 2026-08-22T10:11:57.382Z

Link: CVE-2026-78060

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-23T04:17:08.610

Modified: 2026-08-23T04:17:08.610

Link: CVE-2026-78060

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-23T06:00:11Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')