CVE-2026-93532
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
gedelumbung HospitalManagement up to version c2d45543789a3887067d3915f69d44cfc2cf76a8 has a vulnerability in the password change and profile functions where manipulation of the kode_user/username argument leads to improper authentication. The attack can be launched remotely, and the exploit has been publicly disclosed. The project has not responded.
Risk Assessment
Improper authentication could allow an attacker to change passwords or profile data of other users, potentially leading to account takeover and data breaches.
Recommendation
Apply vendor patches if available, or restrict access to these functions. Monitor the system for unauthorized changes.
Other vulnerabilities in HospitalManagement
See all- CVE-2026-102842Medium
A vulnerability was identified in gedelumbung HospitalManagement in the cekUserLogin function (application/models/app_user_login_model.php) within the KCFinder File Manager component. Manipulation of the ADMIN_RS_KCFINDER argument leads to unrestricted upload. The exploit is publicly available and can be launched remotely.
- CVE-2026-115537Medium
In HospitalManagement (gedelumbung) up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8, the simpan function in application/modules/admin/controllers/routing_pages.php does not properly validate the url_route argument, leading to an open redirect.
- CVE-2026-115536Medium
In HospitalManagement (gedelumbung) up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8, the simpan function in application/modules/admin/controllers/routing_pages.php does not properly handle the content argument, leading to cross-site scripting (XSS).
- CVE-2026-102844Low
A weakness was identified in gedelumbung HospitalManagement affecting the detail function (application/modules/admin/controllers/laporan_data_pasien.php). Manipulation of the id_param argument leads to authorization bypass. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-93531Medium
gedelumbung HospitalManagement up to version c2d45543789a3887067d3915f69d44cfc2cf76a8 has a cross-site request forgery (CSRF) vulnerability in unknown code. The attack can be initiated remotely, and the exploit has been made public. The project has not responded.
- CVE-2026-92221Medium
A vulnerability was determined in gedelumbung HospitalManagement (up to c2d45543789a3887067d3915f69d44cfc2cf76a8) in the generate_index_pasien function of application/models/app_global_admin_model.php. Manipulation of the 'cari' argument can lead to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed and may be utilized. The project has not responded to the issue report.
Original NVD description (English source)
A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function application/modules/global/controllers/password.php::simpan/application/modules/global/controllers/profil.php::simpan of the file application/modules/global/controllers/password.php of the component Password Change Handler. Such manipulation of the argument kode_user/username leads to improper authentication. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS