This vulnerability in gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8 allows remote attackers to perform cross-site scripting via the kirim function in the Guest Book module. The attack vector involves manipulating the nama, email, or pesan arguments, which are not properly sanitized, leading to script injection. The vulnerability is publicly known with an exploit published, but no official patch or version information is available due to the product's rolling release approach. The vendor has not issued a response or fix at the time of this report.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction (UI:P) and has a low complexity (AC:L) with no privileges required (PR:N). The impact on confidentiality is none, but there is low impact on integrity and availability. The CVSS 4.0 score is 5.3 (medium severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. As a temporary measure, input validation and output encoding on the affected parameters (nama, email, pesan) should be enforced to mitigate XSS risks.