Cross Site Scripting Vulnerability in gedelumbung HospitalManagement Contact Form
CVE-2026-115534

5.3MEDIUM

Key Information:

Vendor

Gedelumbung

Status
Hospitalmanagement
Vendor
CVE Published:
22 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-115534?

A cross-site scripting (XSS) vulnerability exists in the gedelumbung HospitalManagement's contact form module. Specifically, the issue lies in the 'kirim' function within the contact.php file, where parameters such as nama, email, alamat, telepon, and pesan can be manipulated by an attacker. This can lead to potential remote attacks that exploit the system's input handling capabilities, allowing adversaries to execute malicious scripts in the context of users' browsers. While the project has been informed of this vulnerability, a response has yet to be issued.

Affected Version(s)

HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-115534 - Proof of Concept

References

https://vuldb.com/vuln/425387
vdb-entrytechnical-description
https://vuldb.com/vuln/425387/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-115534
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

lixiang (VulDB User)
VulDB CNA Team
.