{"id":"CVE-2026-115534","kind":"vulnerability","aliases":["CVE-2026-115534"],"related":[],"title":"HospitalManagement: contact form lets attackers inject cross-site scripting","description":"A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function kirim of the file application/modules/web/controllers/contact.php of the component Contact Form. Executing a manipulation of the argument nama/email/alamat/telepon/pesan can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The contact form handler in gedelumbung HospitalManagement does not sanitize the nama, email, alamat, telepon and pesan fields before output, so a remote user can inject script. A visitor who opens a crafted submission can have script run in their browser session.","severity":"medium","cvss":5.0,"epss":0.00273,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hospital-management","package","php","self-hosted"],"not_affected_if":["contact-form-disabled"],"how_to_check":"- Look for `application/modules/web/controllers/contact.php` in the project and check whether the `kirim` function echoes the nama, email, alamat, telepon or pesan values without escaping.\n- Compare the deployed commit against `c2d45543789a3887067d3915f69d44cfc2cf76a8`; the sources say versions up to that commit are affected.","fix":null,"status":"open","published_at":"2026-10-23T00:16:49+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:29:25+00:00","updated_at":"2026-10-25T04:29:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:29:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"HospitalManagement: contact form lets attackers inject cross-site scripting","impact":"low","summary":"The contact form handler in gedelumbung HospitalManagement does not sanitize the nama, email, alamat, telepon and pesan fields before output, so a remote user can inject script. A visitor who opens a crafted submission can have script run in their browser session.","category":"package","nicknames":[],"who_cares":["php","hospital-management","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Script runs in a visitor's browser on the site","analyst_note":"No fix or patched commit is published and the project has not responded; check the upstream repository for a fix after the cited commit and confirm whether the contact form output is escaped in later versions.","how_to_check":"- Look for `application/modules/web/controllers/contact.php` in the project and check whether the `kirim` function echoes the nama, email, alamat, telepon or pesan values without escaping.\n- Compare the deployed commit against `c2d45543789a3887067d3915f69d44cfc2cf76a8`; the sources say versions up to that commit are affected.","needs_analyst":true,"not_affected_if":["contact-form-disabled"],"who_is_affected":"Teams running the gedelumbung HospitalManagement application with its public contact form enabled are exposed, because the flaw is in that form's handling of submitted fields. The sources do not name a patched release; the project is a rolling release and has not responded to the report. Installations without the contact form exposed to the internet are less at risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3489,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115534':13A,16A '-2026':12A,15A 'affect':134C 'alamat':38B 'application/modules/web/controllers/contact.php':85C 'argument':96C 'attack':5A,105C 'browser':65B 'c2d45543789a3887067d3915f69d44cfc2cf76a8':76C 'compon':88C 'contact':2A,26B,89C 'craft':57B 'cross':8A,101C 'cross-sit':7A 'cve':11A,14A 'deliveri':128C 'determin':70C 'disclos':115C 'earli':147C 'email':37B 'execut':91C,108C 'exploit':111C 'field':42B 'file':84C 'form':3A,27B,90C 'function':80C 'gedelumbung':30B,72C 'handler':28B 'hospit':18B 'hospital-manag':17B 'hospitalmanag':1A,31B,73C 'host':24B 'impact':77C 'implement':122C 'inform':132C,143C 'inject':6A,50B 'issu':150C 'kirim':81C 'lead':99C 'let':4A 'manag':19B 'manipul':93C 'may':117C 'mean':130C 'nama':36B 'nama/email/alamat/telepon/pesan':97C 'ongo':127C 'open':55B 'output':44B 'packag':20B 'pesan':41B 'php':21B 'problem':146C 'product':121C 'project':141C 'public':114C 'releas':125C,137C 'remot':47B,109C 'report':151C 'respond':155C 'roll':124C 'run':62B 'sanit':34B 'script':10A,51B,61B,103C 'self':23B 'self-host':22B 'session':66B 'site':9A,102C 'submiss':58B 'telepon':39B 'unavail':139C 'updat':136C 'user':48B 'util':119C 'version':131C 'visitor':53B 'vulner':68C 'yet':156C","nicknames":[],"mitigations":[],"who_affected":"Teams running the gedelumbung HospitalManagement application with its public contact form enabled are exposed, because the flaw is in that form's handling of submitted fields. The sources do not name a patched release; the project is a rolling release and has not responded to the report. Installations without the contact form exposed to the internet are less at risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T00:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115534","severity":null,"published_at":"2026-10-23T00:16:49+00:00","modified_at":"2026-10-23T21:17:22+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115534","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115534","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}