A flaw in the '/appointments.php' page of Patients Waiting Area Queue Management System 1.0 allows an attacker to inject arbitrary scripts through the 'patient_id' parameter. The lack of proper input sanitization lets malicious code execute in the victim’s browser, enabling session hijacking, defacement, or redirection to phishing sites. The attack can be launched remotely by sending a crafted HTTP request to the publicly accessible PHP file.

This vulnerability impacts Version 1.0 of the Patients Waiting Area Queue Management System developed by Patrick Mvuma and SourceCodester. Administrators should verify that their installations run this version and are exposed to the public web.

The CVSS score of 5.3 indicates medium severity, while the EPSS score of less than 1 % shows a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. An attacker would need network access to the web server and would use the publicly exposed '/appointments.php' endpoint, manipulating the 'patient_id' value with malicious script payloads.