# CVE-2026-115536: gedelumbung HospitalManagement stored XSS in routing pages

Source: https://junglewise.ai/threats/cve-2026-115536-a-security-flaw-has-been-discovered-in-gedelumbung  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-115536 · Severity: medium · CVSS 4.3 · Published 2026-10-23

gedelumbung HospitalManagement is a hospital management system that allows administrators to create custom menu pages with rich content. An authenticated admin can inject malicious JavaScript into the page content field, which is then executed in the browsers of all visitors—including other admins, doctors, and patients—enabling credential theft, malware delivery, and session hijacking.

Technologies: [Gedelumbung HospitalManagement](https://junglewise.ai/threats/technologies/hospitalmanagement). Vendors: [Gedelumbung](https://junglewise.ai/threats/vendors/gedelumbung).

## Quick answers

**Is CVE-2026-115536 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115536 being exploited in the wild.

**How severe is CVE-2026-115536?** Medium severity, with a CVSS score of 4.3, published 23 October 2026.

**Which products and versions are affected?** Gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8.

**Is there a fix for CVE-2026-115536?** No fixed version is recorded yet. Apply output escaping (HTML entity encoding) to the content variable in the view template (application/views/black-inverse/front/bg_pages.php) by changing `<?php echo $content; ?>` to `<?php echo htmlspecialchars($content, ENT_QUOTES, 'UTF-8'); ?>`, or enable CodeIgniter's global XSS filtering by setting `$config['global_xss_filtering'] = TRUE` in application/config/config.php. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-115536 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-115536?** Check whether you run Gedelumbung HospitalManagement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Apply output escaping (HTML entity encoding) to the content variable in the view template (application/views/black-inverse/front/bg_pages.php) by changing `<?php echo $content; ?>` to `<?php echo htmlspecialchars($content, ENT_QUOTES, 'UTF-8'); ?>`, or enable CodeIgniter's global XSS filtering by setting `$config['global_xss_filtering'] = TRUE` in application/config/config.php.

## Technical details

Stored cross-site scripting in the Admin Routing Page simpan function (application/modules/admin/controllers/routing_pages.php) fails to sanitize the content parameter before storing it in the dlmbg_menu database table. The vulnerability is exploited when the public page renderer (web/web::pages() in application/modules/web/controllers/web.php) outputs the unsanitized content directly into the view without escaping, allowing authenticated admin users to plant persistent JavaScript payloads that execute for all subsequent visitors.

## Affected products

- gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8

## Timeline

- 2026-10-09: disclosed: Issue reported on GitHub
- 2026-10-23: advisory

## References

- [https://github.com/gedelumbung/HospitalManagement/](https://github.com/gedelumbung/HospitalManagement/)
- [https://github.com/gedelumbung/HospitalManagement/issues/16](https://github.com/gedelumbung/HospitalManagement/issues/16)

## Related threats

- [gedelumbung HospitalManagement open redirect in routing pages](https://junglewise.ai/threats/cve-2026-115537-a-weakness-has-been-identified-in-gedelumbung-hospitalmanagement)
- [gedelumbung HospitalManagement stored XSS in contact form](https://junglewise.ai/threats/cve-2026-115534-a-vulnerability-was-determined-in-gedelumbung-hospitalmanagement)
- [gedelumbung HospitalManagement stored XSS in Guest Book](https://junglewise.ai/threats/cve-2026-102847-a-flaw-has-been-found-in-gedelumbung-hospitalmanagement-up-to)
- [gedelumbung HospitalManagement improper authorization in configuration handler](https://junglewise.ai/threats/cve-2026-102846-a-vulnerability-was-detected-in-gedelumbung-hospitalmanagement)
- [gedelumbung HospitalManagement information disclosure in HTTP response](https://junglewise.ai/threats/cve-2026-102845-a-security-vulnerability-has-been-detected-in-gedelumbung)