A flaw was identified in the checkin.php file of the Patients Waiting Area Queue Management System 1.0. The flaw stems from inadequate sanitization of the patient_id argument, which allows an attacker to inject malicious script code into the web page. Malicious code execution from injected scripts can lead to defacement, credential theft, or further exploitation if the victim performs privileged actions. This constitutes a cross‑site scripting vulnerability.

The product affected is the Patients Waiting Area Queue Management System 1.0, developed by Patrick Mvuma and available via SourceCodester. The flaw is located in the checkin.php file. The vulnerability can be triggered by manipulating the patient_id parameter.

The CVSS base score is 5.3, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, an exploit has been published and is demonstrable, and the flaw can be triggered remotely by supplying a crafted patient_id value. Attackers could inject arbitrary script, potentially compromising user session data or gaining unauthorized information.