The vulnerability resides in the Patient Registration Module’s registration.php, specifically through unsanitized input of the First Name field. Attackers can inject malicious scripts that are stored and rendered as part of the web page, allowing them to perform actions such as stealing session cookies, defacing content, or executing arbitrary JavaScript in the context of the victim’s browser. This flaw falls under the Common Weakness Enumeration of XSS (CWE‑79) and also involves code injection (CWE‑94), indicating that the input is used without proper validation or encoding.

The affected systems are the Patients Waiting Area Queue Management System developed by Patrick Mvuma and SourceCodester, version 1.0. No other product versions or additional vendor details were provided by the CNA.

The CVSS score of 5.3 reflects a medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no known large‑scale actively exploited attacks. The likely attack vector is remote, as attackers need only to interact with the registration page through a browser. Successful exploitation requires that a user visits a page that reflects the injected script, and the attacker must craft the malicious input prior to the victim’s visit.