---
id: "CVE-2026-115534"
kind: "vulnerability"
aliases: ["CVE-2026-115534"]
title: "HospitalManagement: contact form lets attackers inject cross-site scripting"
severity: "medium"
cvss: 5.0
epss: 0.00273
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hospital-management", "package", "php", "self-hosted"]
not_affected_if: ["contact-form-disabled"]
published_at: "2026-10-23T00:16:49+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:29:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115534", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115534", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HospitalManagement: contact form lets attackers inject cross-site scripting

The contact form handler in gedelumbung HospitalManagement does not sanitize the nama, email, alamat, telepon and pesan fields before output, so a remote user can inject script. A visitor who opens a crafted submission can have script run in their browser session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `application/modules/web/controllers/contact.php` in the project and check whether the `kirim` function echoes the nama, email, alamat, telepon or pesan values without escaping.
- Compare the deployed commit against `c2d45543789a3887067d3915f69d44cfc2cf76a8`; the sources say versions up to that commit are affected.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115534
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115534

## From the sources

A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function kirim of the file application/modules/web/controllers/contact.php of the component Contact Form. Executing a manipulation of the argument nama/email/alamat/telepon/pesan can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_