HospitalManagement CVE-2026-102847

Exploitation requires the Guest Book component to be present and reachable, and a victim to view the guest-book page containing the injected nama/email/pesan payload (UI:P - the payload executes only when someone loads the page). No authentication is needed to submit the entry (PR:N). Affects gedelumbung HospitalManagement at or before commit c2d45543 with no fixed release available, so any current deployment tracking the rolling release is likely exposed. The limiting factor is the required victim interaction and the small, niche installation base.

This is a genuinely low-priority issue despite being a publicly-exploited vulnerability. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, score 2.1) reflects the limited real-world impact: no confidentiality or availability effect and only Low integrity impact confined to the vulnerable system, with user interaction (UI:P) required to land the payload. Public exploit code exists (VulDB #411506, GitHub issue #13), which raises the practical exploitability signal, but there is NO EPSS score, NO CISA KEV listing, and NO evidence of active exploitation - POC availability and active exploitation are distinct and only the former applies here. The dominant risk-reducing factors are the tiny deployment footprint of this niche open-source PHP application and the modest impact of a single guest-book XSS. Note a scoring tension: the vendor's 4.0 score of 2.1 is unusually low for XSS because it credits no confidentiality/subsequent-system impact, whereas typical XSS (session/credential theft in the victim's browser) would warrant a somewhat higher assessment (see assessed vectors). This is a high-visibility-but-low-real-risk finding.

An unauthenticated remote attacker submits a guest-book entry via the buku_tamu.php 'kirim' function, embedding a malicious script in the nama, email, or pesan fields. When a staff member or another visitor later views the guest book, the unsanitized payload executes in their browser, enabling session hijacking, UI defacement, or redirection. Public exploit code for this exact path is available (VulDB / GitHub issue #13).