The reported vulnerability is a cross‑site scripting flaw found in the /admin/?page=room_types endpoint of SourceCodester Hospitals Patient Records Management System. By manipulating the 'room' query parameter, an attacker can inject arbitrary HTML or JavaScript that will be rendered in the browser of a user who views the page. The flaw is remote and requires no special privileges, making it exploitable by anyone that can send a crafted request to the application.

Affected systems are installations of SourceCodester Hospitals Patient Records Management System version 1.0. The vulnerable code resides in the unvalidated handling of the room parameter and the page rendering logic for room_types. The issue is flagged by the CNA for this specific product and version. No other versions are known to be affected.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Since the attack vector is remote web‑based XSS, the risk is that any authenticated or unauthenticated user who visits the affected page could have malicious script executed in their browser, potentially leading to credential theft, session hijacking, or the delivery of malware. Exploitation is straightforward via a crafted URL, and the public exploit code is currently available.