Live › vulnerability › CVE-2026-115535
Go to dashboardThe Settings Handler in gedelumbung HospitalManagement does not sanitize the Title argument in sistem.php::simpan, so injected script is stored and runs in other users' browsers. A public exploit exists, and the project has not responded to the report.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations of gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8 that expose the admin Settings page are affected, since the Title input is stored and rendered. The project ships as a rolling release with no fixed version, so the sources give no patched point. Deployments that do not run this code or that restrict admin access to trusted staff have lower exposure.
No product ranges from the sources yet.
git log -1 --format=%H in the install directory)Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Settings Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-115535")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.