Stored script execution via unsanitized profile fields

Stored XSS in edit-profile.php in SourceCodester Employee Management System 1.0 allows remote authenticated users to execute scripts. The profile update flow stores fullname, phone, date of birth, address, and appointment date without neutralizing script markup before later pages render them. Employee access is required to plant a payload, and a subsequent viewer, including an administrator, executes it in the application origin, enabling session-cookie theft.