CVE-2026-93531
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
gedelumbung HospitalManagement up to version c2d45543789a3887067d3915f69d44cfc2cf76a8 has a cross-site request forgery (CSRF) vulnerability in unknown code. The attack can be initiated remotely, and the exploit has been made public. The project has not responded.
Risk Assessment
A CSRF attack could allow unauthorized actions to be performed on behalf of an authenticated user, potentially leading to data modification or system integrity compromise.
Recommendation
Apply vendor patches if available, or implement CSRF protection mechanisms such as anti-CSRF tokens. Monitor the system for suspicious activities.
Other vulnerabilities in HospitalManagement
See all- CVE-2026-102842Medium
A vulnerability was identified in gedelumbung HospitalManagement in the cekUserLogin function (application/models/app_user_login_model.php) within the KCFinder File Manager component. Manipulation of the ADMIN_RS_KCFINDER argument leads to unrestricted upload. The exploit is publicly available and can be launched remotely.
- CVE-2026-115537Medium
In HospitalManagement (gedelumbung) up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8, the simpan function in application/modules/admin/controllers/routing_pages.php does not properly validate the url_route argument, leading to an open redirect.
- CVE-2026-115536Medium
In HospitalManagement (gedelumbung) up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8, the simpan function in application/modules/admin/controllers/routing_pages.php does not properly handle the content argument, leading to cross-site scripting (XSS).
- CVE-2026-102844Low
A weakness was identified in gedelumbung HospitalManagement affecting the detail function (application/modules/admin/controllers/laporan_data_pasien.php). Manipulation of the id_param argument leads to authorization bypass. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-93532Medium
gedelumbung HospitalManagement up to version c2d45543789a3887067d3915f69d44cfc2cf76a8 has a vulnerability in the password change and profile functions where manipulation of the kode_user/username argument leads to improper authentication. The attack can be launched remotely, and the exploit has been publicly disclosed. The project has not responded.
- CVE-2026-92221Medium
A vulnerability was determined in gedelumbung HospitalManagement (up to c2d45543789a3887067d3915f69d44cfc2cf76a8) in the generate_index_pasien function of application/models/app_global_admin_model.php. Manipulation of the 'cari' argument can lead to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed and may be utilized. The project has not responded to the issue report.
Original NVD description (English source)
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects unknown code. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS