Stored script execution via unfiltered account name

Stored XSS in SourceCodester Accounts Manager App 1.0 allows remote authenticated users to execute script through a crafted account name. The add-account.php endpoint stores the account_name value without filtering it before the accounts page renders the value as active content. A low-privileged user can plant script that runs when another user revisits the accounts page, enabling actions in that victim's browser context.