This vulnerability affects the sfturing hosp_order project up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. It is a cross-site scripting flaw caused by improper sanitization of the Search parameter in an unknown function of HospitalController.java within the Public Search Handlers component. The vulnerability can be exploited remotely without privileges or user interaction, potentially allowing attackers to execute scripts in the context of affected users. The issue was reported early to the project, but no official fix or response has been issued. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary scripts in the victim's browser via the Search parameter, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not require privileges or user interaction but has limited impact as indicated by the CVSS vector (low integrity and availability impact). No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should consider applying input validation or output encoding on the Search parameter as a temporary mitigation. Monitor for vendor updates and apply official patches once available.