HospitalManagement EUVD-2026-108552

Exploitation targets the kirim function in application/modules/web/controllers/contact.php, specifically the Contact Form fields nama, email, alamat, telepon, and pesan, which accept attacker-controlled input that is rendered without adequate output encoding. No authentication is required to submit the payload (PR:N). The key limiting factor is UI:P: the injected script only executes when a victim subsequently views the affected page (realistically an operator or admin reviewing submitted contact entries), so there is no self-contained server-side compromise. Impact is bounded to low integrity in the victim's browser context (VI:L) with no confidentiality or availability impact per the supplied vector. No fixed version exists to deploy because the project ships as a rolling release and, per the description, has not responded to the reporting issue.

This is a low-severity reflected/stored cross-site scripting flaw (CWE-79) in an obscure open-source GitHub project, and the signals are internally consistent toward low real-world priority. The supplied CVSS 4.0 base score is 2.1 with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N - network-reachable and unauthenticated (PR:N) but requiring passive user interaction (UI:P) and yielding only low integrity impact with no confidentiality or availability impact. The vuln.today decision label is 'monitor', the weakest urgency tier, which aligns with the low CVSS. No CISA KEV listing and no EPSS score were provided in the input, so there is no evidence of active exploitation or a quantified exploitation probability. The exploit maturity is E:P (Proof-of-Concept), and the description states the exploit has been publicly disclosed; however, the input does not mark it as confirmed working exploit code, so a public PoC reference exists but is not verified as a working exploit. Net assessment: this is a genuinely low-risk issue, not a high-CVSS-but-overrated case - the ceiling of harm is limited (low integrity, user-interaction-gated), the affected product is niche, and there is no KEV/EPSS signal of widespread exploitation. The one open concern is remediation: the project uses a rolling release with no version identifiers and, per the description, was notified via an issue report but has not responded, so no fix is confirmed available.

An attacker submits a contact form entry via the kirim function of contact.php, placing a malicious script payload into one of the fields (nama, email, alamat, telepon, or pesan). When a victim - most plausibly a site operator or admin reviewing submitted contact messages - opens the affected view, the injected script executes in their browser session. A public PoC reference exists but is not verified as working exploit code.