A cross‑site scripting vulnerability exists in the queue.php file of the Patients Waiting Area Queue Management System. Manipulating the firstname and lastname parameters allows an attacker to inject arbitrary client‑side script into the page. The flaw can be exploited remotely because the arguments are supplied through a web request, and an exploit has been publicly published.

The affected product is the Patients Waiting Area Queue Management System version 1.0 distributed by Patrick Mvuma and SourceCodester. No other versions or configurations are listed in the vulnerability data.

The vulnerability has a CVSS score of 5.1, which indicates medium severity. The EPSS score is below 1%, suggesting a low probability of exploitation at the time of this analysis. The issue is not listed in CISA’s KEV catalog. Exploitation requires only that a user interacts with a malicious firstname or lastname via the queue.php interface, making it a straightforward remote attack if the web application is publicly accessible.