A Cross-Site Scripting (XSS) vulnerability exists in PHPGurukal Hospital Management System version 4.0 on the /hospital/hms/edit-profile.php page. An authenticated patient user can inject malicious script code into the User Name parameter, which is stored and later displayed in the doctor's interface, potentially leading to script execution in that context.