HospitalManagement CVE-2026-115536

Exploitation targets the 'content' argument processed by the simpan function in the Admin Routing Page controller (application/modules/admin/controllers/routing_pages.php). Per the CVSS vector, victim interaction is required (UI:P) - a user must load or view the page where the attacker-controlled content is rendered for the script to fire. The exact trigger mechanism (reflected versus stored XSS) is not described in the available sources. Limiting factors: the flaw lives in an admin-area controller, so reaching the injection point realistically depends on access to that administrative component (the vendor-assigned PR:N is questionable here); impact is confined to the browser context with no confidentiality or availability effect (VC:N/VA:N) and only low integrity impact (VI:L); and there is no verified working exploit, only a PoC reference.

This is a low-to-moderate priority issue despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) and 5.3 base score describe a cross-site scripting flaw with no confidentiality impact (VC:N) and only low integrity impact (VI:L), reflecting the typical blast radius of XSS rather than system compromise. The VulDB-assigned vector states PR:N (no privileges), but the affected element is explicitly the 'Admin Routing Page' component (application/modules/admin/controllers/routing_pages.php) - this is a conflict: an admin controller normally requires authenticated/administrative access to reach, which would argue for PR:L/PR:H; verify the actual access path with the project before treating this as fully unauthenticated. No EPSS score and no KEV listing were provided, and there is no confirmed active exploitation. A GitHub issue is referenced as an 'exploit,' but the input marks it as reference-only and not verified as working exploit code, so this signals disclosure, not weaponization. The vuln.today decision label is 'this_month,' consistent with a real but non-urgent XSS. Overall this reads as a genuine but modest-severity bug, not a high-urgency emergency.

An attacker crafts a malicious payload in the 'content' argument handled by the simpan function of the Admin Routing Page and lures a logged-in user or administrator into viewing the affected page, at which point the script executes in their browser session (UI:P indicates victim interaction is required). A public PoC reference exists in the project's GitHub issue tracker, but it is not verified as working exploit code, so reliability of a turnkey exploit is uncertain.