A flaw in the api_register_patient.php script allows an attacker to inject arbitrary HTML or JavaScript through the firstName and lastName parameters. This leads to cross‑site scripting that can be exploited remotely, allowing the attacker to deface the application, steal session cookies, or perform malicious actions in the context of legitimate users.

The vulnerability affects Patrick Mvuma’s and SourceCodester’s Patients Waiting Area Queue Management System, version 1.0.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is below 1 %, suggesting low current exploitation probability, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires only a crafted request to api_register_patient.php, which can be performed from a remote host. The absence of authentication checks on the input vectors allows the XSS payload to be delivered to any victim who accesses the application after a new patient registration.