CVE-2026-115536
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In HospitalManagement (gedelumbung) up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8, the simpan function in application/modules/admin/controllers/routing_pages.php does not properly handle the content argument, leading to cross-site scripting (XSS).
Risk Assessment
An attacker could remotely inject malicious script that executes in an administrator's browser, enabling session theft or actions on behalf of the victim; the public exploit increases the risk.
Recommendation
Implement proper validation and output encoding of the content input, update the application once a fix is available, and consider deploying Content-Security-Policy headers.
Other vulnerabilities in HospitalManagement
See all- CVE-2026-102842Medium
A vulnerability was identified in gedelumbung HospitalManagement in the cekUserLogin function (application/models/app_user_login_model.php) within the KCFinder File Manager component. Manipulation of the ADMIN_RS_KCFINDER argument leads to unrestricted upload. The exploit is publicly available and can be launched remotely.
- CVE-2026-115537Medium
In HospitalManagement (gedelumbung) up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8, the simpan function in application/modules/admin/controllers/routing_pages.php does not properly validate the url_route argument, leading to an open redirect.
- CVE-2026-102844Low
A weakness was identified in gedelumbung HospitalManagement affecting the detail function (application/modules/admin/controllers/laporan_data_pasien.php). Manipulation of the id_param argument leads to authorization bypass. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-93532Medium
gedelumbung HospitalManagement up to version c2d45543789a3887067d3915f69d44cfc2cf76a8 has a vulnerability in the password change and profile functions where manipulation of the kode_user/username argument leads to improper authentication. The attack can be launched remotely, and the exploit has been publicly disclosed. The project has not responded.
- CVE-2026-93531Medium
gedelumbung HospitalManagement up to version c2d45543789a3887067d3915f69d44cfc2cf76a8 has a cross-site request forgery (CSRF) vulnerability in unknown code. The attack can be initiated remotely, and the exploit has been made public. The project has not responded.
- CVE-2026-92221Medium
A vulnerability was determined in gedelumbung HospitalManagement (up to c2d45543789a3887067d3915f69d44cfc2cf76a8) in the generate_index_pasien function of application/models/app_global_admin_model.php. Manipulation of the 'cari' argument can lead to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed and may be utilized. The project has not responded to the issue report.
Original NVD description (English source)
A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The impacted element is the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component Admin Routing Page. The manipulation of the argument content results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS