Stored XSS via unsanitized account names

XSS in manage_account.php in Sourcecodester Cab Management System 1.0 allows remote authenticated users to run scripts in an administrator browser. The account-update path stores First Name, Middle Name, and Last Name values without neutralizing script markup, and the Registered Clients page renders them for administrators. A client account is required to save the payload, and an administrator must view the client list, exposing browser-accessible session data and enabling actions in that administrator context.