A vulnerability exists in the billing.php script of itsourcecode Hospital Management System that improperly handles the patientid argument, causing unsanitized user input to be reflected back to the browser. This allows an attacker to insert arbitrary JavaScript into the page. The defect is exploitable over a remote web request. The description states the attack can be initiated remotely and the exploit has been disclosed publicly, indicating that attackers can easily construct malicious URLs.

The affected product is itsourcecode Hospital Management System version 1.0, specifically the /billing.php endpoint. The vulnerability arises from unknown processing of the patientid argument in this file.

The CVSS score of 5.3 signals moderate severity, and although no EPSS score is available and the issue is not listed in the CISA KEV catalog, a remote attacker can deliver a malicious payload via a crafted patientid parameter, leading to cross‑site scripting.