The vulnerable function accepts a "content" argument without proper sanitization, which allows an attacker to inject arbitrary script code. When the administrator later renders this data, the injected script executes in the victim’s browser, enabling actions such as phishing, session hijacking, or data exfiltration. This is a classic stored XSS flaw matched to CWE‑79, and the input context also permits arbitrary code execution consistent with CWE‑94. The remote nature of the flaw means that anyone who can reach the Admin Routing Page can trigger the vulnerability.

The flaw targets the gedelumbung HospitalManagement system, specifically the Admin Routing Page component, version up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8. The project employs a rolling release model, so fixed versions may not be publicly enumerated, but any release older than the mentioned commit is susceptible.

The CVSS score of 5.3 rates the vulnerability as medium severity, and the publicly released exploit shows that a remote attacker can easily reach the vulnerable input. Although EPSS data is not available, the absence of a KEV listing does not mitigate the need for remediation. Attackers can exploit the flaw by posting crafted content through the admin interface, causing browsers of other administrators to execute the injected script.