Is CVE-2026-115534 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115534 being exploited in the wild.

How severe is CVE-2026-115534?

Medium severity, with a CVSS score of 4.3, published 23 October 2026.

Which products and versions are affected?

Gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8.

How is CVE-2026-115534 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-115534?

Check whether you run Gedelumbung HospitalManagement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115534: gedelumbung HospitalManagement stored XSS in contact form

CVE-2026-115534 · Severity: medium · CVSS 4.3 · Published 2026-10-23

HospitalManagement is a hospital management system that includes a public contact form. An unauthenticated attacker can submit malicious input through the form fields that gets stored and later executes in the browsers of administrators viewing the contact submissions, leading to potential account compromise or data theft.

Technologies: Gedelumbung HospitalManagement. Vendors: Gedelumbung.

Quick answers

Is CVE-2026-115534 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115534 being exploited in the wild.
How severe is CVE-2026-115534?: Medium severity, with a CVSS score of 4.3, published 23 October 2026.
Which products and versions are affected?: Gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8.
Is there a fix for CVE-2026-115534?: No fixed version is recorded yet. Sanitize and escape all user input from the contact form before storing in the database, and use proper output encoding (HTML entity encoding) when rendering contact fields in admin views. Additionally, enable global XSS filtering in the application configuration or implement a templating engine with automatic escaping. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-115534 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-115534?: Check whether you run Gedelumbung HospitalManagement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Sanitize and escape all user input from the contact form before storing in the database, and use proper output encoding (HTML entity encoding) when rendering contact fields in admin views. Additionally, enable global XSS filtering in the application configuration or implement a templating engine with automatic escaping.

Technical details

A stored cross-site scripting vulnerability exists in the contact form handler (kirim function) in application/modules/web/controllers/contact.php. User-supplied input from the nama, email, alamat, telepon, and pesan fields is inserted directly into the database without sanitization and rendered unescaped in both the admin contact listing and edit views. An unauthenticated attacker can submit a payload that will execute in the context of every administrator's session who views the contact list or edit page.

Affected products

gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8

Timeline

2026-10-09: disclosed: Issue reported on GitHub
2026-10-23: advisory: CVE-2026-115534 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.