A flaw in the sfturing ssm_pro Order Endpoint allows an attacker to inject arbitrary HTML or JavaScript by manipulating request arguments such as hospitalName, officesName, or doctorName. This cross‑site scripting can run code in the context of authenticated users who view the affected page, potentially exposing sensitive data, hijacking sessions, or modifying page content. The vulnerability is rooted in inadequate input validation (CWE‑79) and execution of untrusted code paths (CWE‑94).

The affected product is sfturing ssm_pro, up to the code commit 627f426331da8086ce8fff2017d65b1ddef384f8. No specific upstream version number is provided, but any release before that commit remains vulnerable. Instances of the application that expose the Order Endpoint and accept user‑supplied hospitalName, officesName, or doctorName parameters are affected.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. The description states that the exploit can be initiated remotely, and that a published exploit exists, implying that attackers can reach the vulnerable input fields over the network. No additional conditions such as privileged access or local execution are required, suggesting that exploitation risk remains in any environment where the endpoint is exposed to the internet or an untrusted network.