# CVE-2026-115534: gedelumbung HospitalManagement stored XSS in contact form

Source: https://junglewise.ai/threats/cve-2026-115534-a-vulnerability-was-determined-in-gedelumbung-hospitalmanagement  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-115534 · Severity: medium · CVSS 4.3 · Published 2026-10-23

HospitalManagement is a hospital management system that includes a public contact form. An unauthenticated attacker can submit malicious input through the form fields that gets stored and later executes in the browsers of administrators viewing the contact submissions, leading to potential account compromise or data theft.

Technologies: [Gedelumbung HospitalManagement](https://junglewise.ai/threats/technologies/hospitalmanagement). Vendors: [Gedelumbung](https://junglewise.ai/threats/vendors/gedelumbung).

## Quick answers

**Is CVE-2026-115534 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115534 being exploited in the wild.

**How severe is CVE-2026-115534?** Medium severity, with a CVSS score of 4.3, published 23 October 2026.

**Which products and versions are affected?** Gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8.

**Is there a fix for CVE-2026-115534?** No fixed version is recorded yet. Sanitize and escape all user input from the contact form before storing in the database, and use proper output encoding (HTML entity encoding) when rendering contact fields in admin views. Additionally, enable global XSS filtering in the application configuration or implement a templating engine with automatic escaping. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-115534 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-115534?** Check whether you run Gedelumbung HospitalManagement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Sanitize and escape all user input from the contact form before storing in the database, and use proper output encoding (HTML entity encoding) when rendering contact fields in admin views. Additionally, enable global XSS filtering in the application configuration or implement a templating engine with automatic escaping.

## Technical details

A stored cross-site scripting vulnerability exists in the contact form handler (kirim function) in application/modules/web/controllers/contact.php. User-supplied input from the nama, email, alamat, telepon, and pesan fields is inserted directly into the database without sanitization and rendered unescaped in both the admin contact listing and edit views. An unauthenticated attacker can submit a payload that will execute in the context of every administrator's session who views the contact list or edit page.

## Affected products

- gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8

## Timeline

- 2026-10-09: disclosed: Issue reported on GitHub
- 2026-10-23: advisory: CVE-2026-115534 published

## References

- [https://github.com/gedelumbung/HospitalManagement/](https://github.com/gedelumbung/HospitalManagement/)
- [https://github.com/gedelumbung/HospitalManagement/issues/14](https://github.com/gedelumbung/HospitalManagement/issues/14)

## Related threats

- [gedelumbung HospitalManagement open redirect in routing pages](https://junglewise.ai/threats/cve-2026-115537-a-weakness-has-been-identified-in-gedelumbung-hospitalmanagement)
- [gedelumbung HospitalManagement stored XSS in routing pages](https://junglewise.ai/threats/cve-2026-115536-a-security-flaw-has-been-discovered-in-gedelumbung)
- [gedelumbung HospitalManagement stored XSS in Guest Book](https://junglewise.ai/threats/cve-2026-102847-a-flaw-has-been-found-in-gedelumbung-hospitalmanagement-up-to)
- [gedelumbung HospitalManagement improper authorization in configuration handler](https://junglewise.ai/threats/cve-2026-102846-a-vulnerability-was-detected-in-gedelumbung-hospitalmanagement)
- [gedelumbung HospitalManagement information disclosure in HTTP response](https://junglewise.ai/threats/cve-2026-102845-a-security-vulnerability-has-been-detected-in-gedelumbung)