An authenticated clinical user can inject event-handler markup by storing values containing double quotes. This occurs because the `text()` function uses ENT NOQUOTES when rendering stored `transfer to`, `code`, and `codetext` values within double-quoted HTML value attributes at the 'interface/forms/transfer summary/new.php' and 'interface/forms/functional cognitive status/new.php' endpoints. Successful exploitation can expose session data and protected health information or allow unauthorized patient-record actions within the victim's session.