Stored XSS via unsanitized demail parameter

Hospital Management System v1.0 contains stored cross-site scripting in the demail parameter, allowing remote authenticated users to inject script. The admin-panel1.php handler stores attacker-controlled demail content without neutralizing it before later HTML rendering, so a visiting user executes the payload in the application origin. Exploitation requires authenticated access to submit the parameter and a victim to view the affected page; the demonstrated impact is script execution in the victim browser, enabling data theft or actions available to that session.