This vulnerability in code-projects Home Service System 1.0 involves a cross-site scripting flaw in the Appointment Booking component's /booking.php file. Specifically, the fname and lname parameters can be manipulated to inject malicious scripts, which may be executed in the context of a victim's browser. The vulnerability is remotely exploitable without authentication and requires user interaction (UI:P). The CVSS 4.0 base score is 5.3, indicating medium severity. No vendor advisory or patch information is provided, and the remediation level is unknown.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users interacting with the vulnerable booking page. This may lead to theft of user credentials, session hijacking, or other malicious actions performed via the victim's browser. However, the vulnerability requires user interaction and does not grant direct system access or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with the affected application, especially with untrusted input in the fname and lname fields. Implementing input validation and output encoding on these parameters may reduce risk if source code access is possible.