This vulnerability affects SourceCodester Hospitals Patient Records Management System 1.0. It arises from insufficient input validation or sanitization of the 'room' parameter in the /admin/?page=room_types endpoint, enabling an attacker to perform cross-site scripting attacks remotely. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required but user interaction needed, and limited impact on confidentiality and integrity. The exploit code is publicly available, but there are no known exploits in the wild at this time. No official remediation or patch has been disclosed.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application for users who interact with the vulnerable parameter. This can lead to session hijacking, defacement, or other client-side attacks. The impact is limited to the confidentiality and integrity of user interactions with the affected page, with no direct impact on availability or system-level privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or sanitization controls on the 'room' parameter if possible, or restrict access to the affected administrative page. Monitor vendor channels for updates and patches.