This vulnerability affects SourceCodester Hospitals Patient Records Management System 1.0, specifically in the processing of the 'room' argument within the /admin/?page=room_types endpoint. An attacker can remotely manipulate this argument to execute cross-site scripting attacks. The CVSS 4.0 base score is 4.8, indicating medium severity with network attack vector, low attack complexity, and requiring high privileges and user interaction. No vendor-provided patch or official remediation is currently documented.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability requires high privileges and user interaction, which limits the ease of exploitation. There is no indication of direct impact on confidentiality, integrity, or availability beyond the XSS scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected page to trusted administrators only and applying web application firewall (WAF) rules to detect and block XSS payloads targeting the 'room' parameter. Monitor for updates from SourceCodester regarding patches or official mitigations.