A stored cross‑site scripting flaw exists in the patient profile editing page of PHPGurukal Hospital Management System v4.0. Authenticated patients can inject a script into the User Name field; the value is then stored and later rendered in the doctor's interface. The injected script runs with the privileges of the doctor who views the page, potentially allowing session hijacking, data exfiltration, or defacement of the doctor’s view.

PHPGurukal Hospital Management System, version 4.0. The vulnerability is located in /hospital/hms/edit-profile.php and affects the processing and display of the User Name field.

The exploit requires an authenticated patient account and is therefore limited to users with valid credentials. No EPSS score is available and the issue is not listed in the CISA KEV catalog. However, because it is a stored XSS that can affect doctor users, the potential impact on confidentiality and integrity is high. The lack of available mitigation from the vendor means the risk remains significant until a patch or secure input handling is applied.