CVE-2026-115534
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was found in the gedelumbung HospitalManagement application, specifically in the kirim function of application/modules/web/controllers/contact.php within the Contact Form component. Manipulating the nama, email, alamat, telepon, or pesan arguments can lead to script execution. The attack can be performed remotely, and a public exploit has been disclosed.
Risk Assessment
This XSS vulnerability may allow an attacker to execute arbitrary scripts in a user's browser, leading to session theft, account takeover, or content manipulation. Given the public exploit, the risk of exploitation is high.
Recommendation
Immediately implement input validation and sanitization in the contact form and apply Content-Security-Policy headers. Until the vendor releases a fix, restrict access to the contact module or disable it.
Other vulnerabilities in gedelumbung HospitalManagement
See all- CVE-2026-102845Medium
A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function error_reporting of the file index.php of the component HTTP Response. The manipulation leads to information disclosure. The attack may be initiated remotely, and the exploit has been disclosed publicly.
- CVE-2026-115535Low
In gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8, the function sistem.php::simpan in application/modules/admin/controllers/sistem.php (Settings Handler component) is vulnerable to cross-site scripting via manipulation of the Title argument. The attack can be carried out remotely, and the exploit is publicly available and may be used. The project uses a rolling release strategy, so version details cannot be specified.
- CVE-2026-102847Medium
A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/buku_tamu.php of the component Guest Book. This manipulation of the argument nama/email/pesan causes cross site scripting. Remote exploitation is possible, and the exploit has been published.
- CVE-2026-102846Medium
A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument tipe/title/content_setting results in improper authorization. The attack may be launched remotely, and the exploit is now public.
- CVE-2026-102843Medium
A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the file application/modules/admin/controllers/data_galeri.php of the component Endpoint. Performing a manipulation of the argument gbr results in path traversal. The attack can be initiated remotely, and the exploit has been released to the public.
Original NVD description (English source)
A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function kirim of the file application/modules/web/controllers/contact.php of the component Contact Form. Executing a manipulation of the argument nama/email/alamat/telepon/pesan can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS