Best Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change username field.