The flaw lies in the Public Search Handlers component of HospitalController.java where the Search query parameter is not properly sanitized. An attacker can inject malicious JavaScript that will run in the browsers of any user who views the corrupted search results. According to the CVE description, the attack can be performed remotely and the exploit is publicly available. The vulnerability maps to CWE-79 (Cross‑Site Scripting) and CWE-94 (Execution of Arbitrary Code). If exploited, an attacker could steal session cookies, deface pages, or redirect users to phishing sites, compromising both confidentiality and integrity of user data.

The affected vendor is sfturing, with the product hosp_order. The vulnerability exists in all releases up to the commit hash 627f426331da8086ce8fff2017d65b1ddef384f8. Because the source is open‑source and the issue was reported without a patch, any installation that has not been updated beyond this commit remains vulnerable. No other vendors or versions are listed.

The CVSS score is 5.3, indicating a medium impact. The EPSS score is not available, and the vulnerability is not currently listed in CISA's KEV catalog, but the publicly available exploit suggests a practical threat. The lack of a vendor response and the presence of the issue in the codebase mean attackers can target any exposed instance. This combination of moderate CVSS, publicly available exploit, and no remedial patch highlights the need for rapid assessment and mitigation.