CVE-2026-115535: Cross Site Scripting in gedelumbung HospitalManagement

This vulnerability exists in the gedelumbung HospitalManagement system up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected code is in application/modules/admin/controllers/sistem.php, specifically the sistem.php::simpan function in the Settings Handler component. Manipulation of the Title parameter allows an attacker to perform cross-site scripting (XSS) attacks remotely. The software follows a rolling release strategy, so no discrete version numbers are provided for affected or fixed releases. The vulnerability was responsibly disclosed but has not yet been addressed by the project. Public exploit code is available, though no active exploitation in the wild is confirmed.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction (UI:P) and privileges (PR:H) but no user consent (AT:N). The overall impact is rated medium severity with a CVSS 4.0 score of 4.8.

No official patch or fix has been released yet, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is available, consider applying input validation or sanitization on the Title parameter at the application or web server level to mitigate XSS risks. Avoid exposing the vulnerable function to untrusted users if possible.