CVE-2026-115534: medium-severity vulnerability in gedelumbung HospitalManagement
gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting
Published · Updated
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
exploitation probability
0.3%top 72% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function kirim of the file application/modules/web/controllers/contact.php of the component Contact Form. Executing a manipulation of the argument nama/email/alamat/telepon/pesan can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
gedelumbung · HospitalManagementpublic PoCs found — 1
cve_referencegithub.com/gedelumbung/HospitalManagement/issues/14unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — gedelumbung HospitalManagement
In the same product, most dangerous first.
CVE-2026-93532MEDIUMgedelumbung HospitalManagement Password Change password.php simpan improper authenticationEPSS 0.5%CVE-2026-92221MEDIUMgedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injectionEPSS 0.3%CVE-2026-102843MEDIUMgedelumbung HospitalManagement Endpoint data_galeri.php hapus path traversalEPSS 0.3%CVE-2026-115537MEDIUMgedelumbung HospitalManagement URL Validation routing_pages.php simpan redirectEPSS 0.3%CVE-2026-102845MEDIUMgedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosureEPSS 0.3%CVE-2026-102842MEDIUMgedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted uploadEPSS 0.3%