The vulnerability is a reflected XSS error triggered by the msg parameter in the feedback.php file. An attacker can inject arbitrary JavaScript that will run in the browser of any user who views the crafted page, potentially enabling session hijacking, defacement, or data theft. The underlying weakness stems from a failure to properly validate or encode user‑supplied data, which is a classic input validation flaw. The flaw permits the execution of arbitrary code in the context of the victim’s browser and therefore threatens the confidentiality, integrity, and non‑repudiation of user interactions with the application.

Only the project named subhajitkhan online‑clinic‑management‑system is affected. The product is maintained in a repository with continuous delivery and rolling releases. No specific version restrictions are documented; all code preceding and including the commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 may be vulnerable. Consequently, any deployment using the current source is at risk until a fix is released.

The CVSS score of 5.3 places the vulnerability in the moderate range, and the EPSS score is unavailable. It is not listed in the CISA KEV catalog. The flaw can be exploited remotely by sending a HTTP request containing a malicious payload in the msg argument. Because the attack relies on victim interaction (viewing the response), the likelihood of successful exploitation depends on user behavior and the presence of mitigations such as CSP. Public disclosure has made exploit code available, indicating that an attacker can readily exercise the flaw if the application remains uncompromised.