Administrator script execution via stored fullname

Stored cross-site scripting in SourceCodester Simple Cashiering System allows remote authenticated users to run script in an administrator's browser. The account-update path stores the fullname value without effective output neutralization, and user and sales views render it as active HTML. A cashier account can plant the payload, but execution requires an administrator to open the user list or a sales record; the script runs in that administrator's session.