CVE-2026-115535
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8, the function sistem.php::simpan in application/modules/admin/controllers/sistem.php (Settings Handler component) is vulnerable to cross-site scripting via manipulation of the Title argument. The attack can be carried out remotely, and the exploit is publicly available and may be used. The project uses a rolling release strategy, so version details cannot be specified.
Risk Assessment
An attacker can execute script in the victim's browser, hijack the session, or perform actions on behalf of the user, potentially leading to account takeover or further attacks.
Recommendation
Apply patches or mitigations (e.g., input validation and sanitization) and consider restricting access to the administrative interface.
Other vulnerabilities in gedelumbung HospitalManagement
See all- CVE-2026-102845Medium
A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function error_reporting of the file index.php of the component HTTP Response. The manipulation leads to information disclosure. The attack may be initiated remotely, and the exploit has been disclosed publicly.
- CVE-2026-115534Medium
A cross-site scripting (XSS) vulnerability was found in the gedelumbung HospitalManagement application, specifically in the kirim function of application/modules/web/controllers/contact.php within the Contact Form component. Manipulating the nama, email, alamat, telepon, or pesan arguments can lead to script execution. The attack can be performed remotely, and a public exploit has been disclosed.
- CVE-2026-102847Medium
A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/buku_tamu.php of the component Guest Book. This manipulation of the argument nama/email/pesan causes cross site scripting. Remote exploitation is possible, and the exploit has been published.
- CVE-2026-102846Medium
A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument tipe/title/content_setting results in improper authorization. The attack may be launched remotely, and the exploit is now public.
- CVE-2026-102843Medium
A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the file application/modules/admin/controllers/data_galeri.php of the component Endpoint. Performing a manipulation of the argument gbr results in path traversal. The attack can be initiated remotely, and the exploit has been released to the public.
Original NVD description (English source)
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Settings Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS