A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 via the last_name parameter in the (1) patient/insert (2) patient_report (3) /appointment_report (4) visit_report and (5) /bill_detail_report pages.