An attacker can insert malicious script into the Query parameter that is reflected unescaped by the patdocmsg.php script in subhajitkhan’s online‑clinic‑management‑system. The flaw is a classic cross‑site scripting vulnerability (CWE-79) and involves code injection (CWE-94) due to unvalidated input. Execution of the injected script occurs in the victim’s browser, enabling the attacker to run arbitrary JavaScript, which can be used for session hijacking, defacement, or data exfiltration.

The online‑clinic‑management‑system application maintained by subhajitkhan is impacted. The advisory references the specific commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 as the point of vulnerability. No explicit version ranges are given, implying that any copy of the project containing that commit may be vulnerable until the issue is fixed.

The assigned CVSS score of 5.1 indicates medium severity, and the absence of an EPSS value means the exploitation probability could not be quantified. The vulnerability is not listed in CISA’s KEV catalog, but publicly available proof‑of‑concepts exist and the attack can be carried out from a remote context. Because the project has not yet released a formal fix, the overall risk remains moderate to high and timely remediation is strongly recommended.