A stored cross‑site scripting flaw exists in PHPGurukal Hospital Management System v4.0 that allows an authenticated patient to inject a script into the User Name field of the edit‑profile page. The malicious payload is saved and later rendered in a doctor’s view, giving the attacker the ability to execute arbitrary JavaScript within that context. The resulting script runs with the privileges of the doctor who views the page, potentially compromising session data or displaying malicious content.

PHPGurukal Hospital Management System version 4.0, specifically the /hospital/hms/edit-profile.php module. The vulnerability affects how user‑supplied input is stored and later presented on doctor‑visible interfaces.

The CVSS score of 5.4 indicates moderate severity. No EPSS score is currently available and the issue is not listed in the CISA KEV catalog. The exploit requires an authenticated patient account, limiting the attack surface to users with valid credentials. While the impact is that doctors could inadvertently execute malicious scripts, the risk remains moderate and is constrained to contexts where doctor sessions view the edited username. Efforts to mitigate this risk rely on vendor updates or proper input handling.