This vulnerability in code-projects Hospital Information System 1.0 involves a cross-site scripting flaw in the Patient Management component, specifically in the /HIS/src/patients/editPatient.php file. Manipulation of the ID parameter can lead to injection of malicious scripts, which may be executed in the context of a victim's browser. The attack can be launched remotely without authentication. The vulnerability has been publicly disclosed, but no official patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction (UI:P) and low privileges (PR:L) but no authentication is needed to launch the attack. The overall impact is rated medium based on the CVSS 4.0 score of 5.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. In the meantime, applying input validation or output encoding on the ID parameter in the affected file may mitigate the risk. Avoiding use of the vulnerable functionality or restricting access could also reduce exposure.