Live › vulnerability › CVE-2026-115534
Go to dashboardThe contact form handler in gedelumbung HospitalManagement does not sanitize the nama, email, alamat, telepon and pesan fields before output, so a remote user can inject script. A visitor who opens a crafted submission can have script run in their browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the gedelumbung HospitalManagement application with its public contact form enabled are exposed, because the flaw is in that form's handling of submitted fields. The sources do not name a patched release; the project is a rolling release and has not responded to the report. Installations without the contact form exposed to the internet are less at risk.
No product ranges from the sources yet.
application/modules/web/controllers/contact.php in the project and check whether the kirim function echoes the nama, email, alamat, telepon or pesan values without escaping.c2d45543789a3887067d3915f69d44cfc2cf76a8; the sources say versions up to that commit are affected.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function kirim of the file application/modules/web/controllers/contact.php of the component Contact Form. Executing a manipulation of the argument nama/email/alamat/telepon/pesan can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-115534")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.