The mojoomla Hospital Management System contains a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This vulnerability affects versions up to 47.0 and allows an attacker to inject malicious scripts that execute when a user interacts with crafted web content. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser session. This may lead to partial disclosure of sensitive information, modification of web content, or disruption of availability within the affected application. The CVSS vector indicates that the attacker does not require privileges but does require user interaction to trigger the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted input or links related to the mojoomla Hospital Management System. Monitor vendor communications for updates on patches or mitigations.