CVE-2026-115535: gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Settings Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated attacker with high privileges and user interaction. The attack can be performed remotely, and public exploit code is available.
Are installations using the default configuration affected?
The available information does not state whether a default configuration is affected. Exposure depends on whether a high-privileged user can submit a crafted Title value through the Settings Handler.
What can be done while no vendor fix is available?
Restrict access to the settings functionality and limit high-privileged accounts to trusted administrators. Review and sanitize Title values submitted through the affected settings workflow, and treat stored or displayed values as potentially untrusted.
How can administrators check for potential exploitation?
Review Settings Handler activity and stored Title values for unexpected markup or script content. Focus on requests reaching application/modules/admin/controllers/sistem.php and the sistem.php::simpan function.