A weakness exists in the registration page of SourceCodester Doctor Appointment System 1.0. Manipulating the Email argument when submitting the form causes the server to reflect unsanitized user input back to the browser, enabling cross‑site scripting. The flaw is categorized as CWE‑79 and, based on the description, a secondary code injection issue is also referenced as CWE‑94. An attacker who can supply an injected payload in the Email field can execute arbitrary JavaScript in the context of the victim’s browser session, potentially hijacking cookies or performing other malicious actions.

SourceCodester: Doctor Appointment System version 1.0 is affected by this vulnerability. No other product versions are listed.

The CVSS base score for this issue is 5.3, indicating moderate severity. EPSS suggests an extremely low exploitation probability (<1 %). The vulnerability is not listed in CISA’s KEV catalog, and publicly available proof‑of‑concept code demonstrates a remote attack path that simply requires sending a crafted HTTP request to the register.php endpoint.