Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Low | 2.1 | CVE-2026-115537 |
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
gedelumbunggedelumbung HospitalManagement
|
NVD | |||
|
CVE-2026-115537A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
Executive summaryThe gedelumbung HospitalManagement application has an open redirect flaw in its custom menu feature, letting an admin-stored URL redirect visitors to any external site. The advisory says an attacker could use the hospital's trusted domain to help phishing campaigns, and it gives a CVSS 3.1 score of 6.1 (Medium). The advisory does not state a vendor fix or recommended remediation. Technical summaryThis is an open redirect (CWE class not stated) in the web/web::pages controller, where the url_route value saved by the admin routing_pages controller is passed unvalidated to a redirect call. The advisory says exploitation requires a logged-in admin to store the URL, and the public page at /web/pages/<id> then returns a 302 to that URL without authentication; the CVSS vector is AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N. The affected version is stated as commit c2d45543789a3887067d3915f69d44cfc2cf76a8 and earlier, with no fixed version stated. No workaround is stated, and the advisory gives no detection guidance beyond the reproduction steps. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/gedelumbung/HospitalManagement/issues/17 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.1 | CVE-2026-115536 |
A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
gedelumbunggedelumbung HospitalManagement
|
NVD | |||
|
CVE-2026-115536A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
Executive summaryA stored cross-site scripting flaw in the gedelumbung HospitalManagement application lets a logged-in administrator place script code on public menu pages that runs in the browser of any visitor. The advisory rates it Medium with a CVSS 3.1 score of 5.4. The advisory does not state a vendor fix or workaround. Technical summaryThe flaw is stored cross-site scripting (CWE-style class not named, described as Cross Site Scripting (stored)) in the admin/routing_pages content field. The save endpoint writes raw CKEditor HTML into the dlmbg_menu table without escaping, and the public renderer echoes it unescaped in bg_pages.php. The advisory says exploitation requires an authenticated admin account (PR:L) and user interaction (UI:R), with the attack network-reachable and scope changed; CVSS vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4. The advisory states the affected commit is c2d45543789a3887067d3915f69d44cfc2cf76a8, and no fixed version or patch is stated. No workaround is stated beyond the root cause noting that global_xss_filtering is disabled. Detection guidance is limited to the reproduction steps; a more specific detection method is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/gedelumbung/HospitalManagement/issues/16 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 1.9 | CVE-2026-115535 |
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
gedelumbunggedelumbung HospitalManagement
|
NVD | |||
|
CVE-2026-115535A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
From the advisoryA vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Settings Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet. Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.1 | CVE-2026-115534 |
A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
gedelumbunggedelumbung HospitalManagement
|
NVD | |||
|
CVE-2026-115534A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
Executive summaryA stored cross-site scripting flaw in the gedelumbung HospitalManagement web contact form lets anonymous visitors plant code that runs in administrators' browsers when they view contact records. The advisory rates it Medium with a CVSS 3.1 score of 6.1 and the attack can lead to admin session theft and account takeover. The advisory does not state a vendor fix or recommended remediation. Technical summaryThis is a stored cross-site scripting (XSS) vulnerability. The public form at /web/contact/kirim writes visitor-supplied nama, email, alamat, telepon and pesan values into the dlmbg_contact table without escaping, and the admin list and edit views output them unescaped, with the alamat and pesan values placed inside CKEditor textarea elements. No authentication is needed to submit the payload, but victim admins must view the affected pages, so the CVSS vector lists user interaction as required. The affected version is stated as up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8, and no fixed version is stated. The advisory states that the global XSS filter is disabled in config.php, and it describes the root cause as shared with a separate buku_tamu XSS issue. No workaround and no detection guidance are stated, and the advisory does not say whether the flaw is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/gedelumbung/HospitalManagement/issues/14 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.1 | CVE-2026-102847 |
A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
gedelumbunggedelumbung HospitalManagement
|
NVD | |||
|
CVE-2026-102847A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
From the advisoryA flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/buku_tamu.php of the component Guest Book. This manipulation of the argument nama/email/pesan causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet. Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.0 | CVE-2026-102846 |
A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
gedelumbunggedelumbung HospitalManagement
|
NVD | |||
|
CVE-2026-102846A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
From the advisoryA vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument tipe/title/content_setting results in improper authorization. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet. Impact if exploitedConfidentialityLow IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.5 | CVE-2026-102845 |
A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
gedelumbunggedelumbung HospitalManagement
|
NVD | |||
|
CVE-2026-102845A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
From the advisoryA security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function error_reporting of the file index.php of the component HTTP Response. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.0 | CVE-2026-102844 |
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
gedelumbunggedelumbung HospitalManagement
|
NVD | |||
|
CVE-2026-102844A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
From the advisoryA weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the file application/modules/admin/controllers/laporan_data_pasien.php. Executing a manipulation of the argument id_param can lead to authorization bypass. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet. Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.0 | CVE-2026-102843 |
A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
gedelumbunggedelumbung HospitalManagement
|
NVD | |||
|
CVE-2026-102843A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
From the advisoryA security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the file application/modules/admin/controllers/data_galeri.php of the component Endpoint. Performing a manipulation of the argument gbr results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet. Impact if exploitedConfidentialityLow IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.1 | CVE-2026-102842 |
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
gedelumbunggedelumbung HospitalManagement
|
NVD | |||
|
CVE-2026-102842A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
From the advisoryA vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app_user_login_model.php::cekUserLogin of the file application/models/app_user_login_model.php of the component KCFinder File Manager. Such manipulation of the argument ADMIN_RS_KCFINDER leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet. Impact if exploitedConfidentialityLow IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||