CVE-2026-78060
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability was found in SourceCodester Stock Management System 1.0. The file /php_action/getOrderReport.php is vulnerable to cross-site scripting via manipulation of clientName/clientContact arguments. The attack can be initiated remotely and the exploit has been made public.
Risk Assessment
An attacker can inject malicious scripts that execute in the victim's browser, potentially leading to session theft, account takeover, or other attacks.
Recommendation
Update the system to a patched version and validate/sanitize input data.
Other vulnerabilities in SourceCodester Stock Management System
See all- CVE-2026-78059Medium
A vulnerability has been found in SourceCodester Stock Management System 1.0. The file /php_action/printOrder.php is vulnerable to cross-site scripting via manipulation of clientName/clientContact arguments. The attack may be performed remotely and the exploit has been disclosed publicly.
- CVE-2026-19925Medium
A vulnerability was detected in SourceCodester Stock Management System 1.0 in the file /classes/Master.php?f=delete_supplier. Manipulating the ID argument results in SQL injection. The attack can be launched remotely, and the exploit is public.
Original NVD description (English source)
A vulnerability was found in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /php_action/getOrderReport.php. Performing a manipulation of the argument clientName/clientContact results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.