An input validation flaw in the booking.php file of the Appointment Booking component allows the fname and lname parameters to be manipulated, resulting in cross‑site scripting. The vulnerability can be triggered by a remote attacker submitting malicious data; once injected, scripts execute in the victim’s browser, potentially compromising sessions or enabling further malicious activity.

The affected product is code‑projects Home Service System version 1.0, specifically the booking.php module within the Appointment Booking component. Users running this release are vulnerable when interacting with the fname and lname input fields.

The CVSS score of 5.3 categorizes the flaw as moderate in severity, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker can initiate the attack remotely via crafted fname/lname submissions, potentially leading to arbitrary script execution within the context of the application.