PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-115536 gedelumbung CVE debrief

A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The impacted element is the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component Admin Routing Page. The manipulation of the argument content results in cross site scripting. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.

Vendor
gedelumbung
Product
HospitalManagement
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-29
Advisory published
2026-10-23
Advisory updated
2026-10-29

Who should care

Defenders responsible for systems using the HospitalManagement component, especially those with exposure to the Admin Routing Page, should assess the vulnerability and prioritize verification of their inventory.

Why it matters

Defenders should prioritize verifying exposure in their inventory, especially for systems using the affected HospitalManagement component, and assess the feasibility of cross-site scripting attacks.

  • Defenders must verify exposure in their inventory, especially for systems using the affected HospitalManagement component.
  • Cross-site scripting attacks may be performed remotely, potentially leading to unauthorized actions.
  • Defenders should assess the feasibility of cross-site scripting attacks and consider compensating controls.
  • Version information for affected or updated releases is not disclosed due to the rolling release system.

Technical summary

The vulnerability exists in the simpan function of the routing_pages.php file in the Admin Routing Page component of gedelumbung HospitalManagement. An attacker can perform a cross-site scripting attack by manipulating the content argument. The attack can be performed remotely. This issue affects systems using the HospitalManagement component, particularly those with exposure to the Admin Routing Page. Defenders should assess the feasibility of cross-site scripting attacks and prioritize verification of their inventory. Due to the rolling release system, specific version information for affected or updated releases is not disclosed.

Defensive priority

Defenders should prioritize verifying exposure in their inventory, especially for systems using the affected HospitalManagement component, and assess the feasibility of cross-site scripting attacks.

Recommended defensive actions

  • Verify inventory for systems using the affected HospitalManagement component
  • Assess the feasibility of cross-site scripting attacks
  • Monitor for potential exploitation attempts
  • Consider compensating controls for input validation and content security policy
  • Review vendor guidance for patching or mitigating the vulnerability
  • Perform a thorough review of system logs for signs of exploitation
  • Implement additional security measures such as web application firewalls

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected component, and potential attack vector. However, due to the rolling release system, specific version information for affected or updated releases is not disclosed.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-115536 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-115536

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-115536 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-115536

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115536.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/425389

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/425389/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-115536

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/1021800

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/gedelumbung/HospitalManagement/issues/16

    Supplemental source - exploit, issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/gedelumbung/HospitalManagement/

    Supplemental source - product

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.