A stored cross‑site scripting vulnerability exists in the Hospitals Patient Records Management System where an attacker can manipulate the Remarks argument in the /admin/?page=patients/view_patient endpoint. This allows injection of malicious scripts that run in the browser of anyone who views the affected patient record, potentially leading to session hijacking, credential theft, defacement or other client‑side attacks. The flaw is based on CWE‑79 and also involves unsanitized code paths suggesting CWE‑94. Because the vulnerable element resides in a publicly accessible administration page, remote exploitation is feasible and the exploit code has already been released publicly.

The vulnerability affects the SourceCodester and oretnom23 variants of the Hospitals Patient Records Management System, version 1.0, particularly the /admin/?page=patients/view_patient page that processes the Remarks field. No other versions or extensions were mentioned as impacted.

The CVSS score of 4.8 indicates a moderate impact, with the EPSS score not available and the vulnerability not listed in the CISA KEV catalog. The attack vector is remote and does not require privileged credentials, relying only on sending a crafted URL or form submission to the admin page. An attacker could embed arbitrary JavaScript, achieving malicious client‑side activity on any browser that loads the affected page. Mitigation is supported primarily by applying a vendor patch, otherwise the defect can be mitigated by proper input validation and output encoding.