gedelumbung HospitalManagement EUVD-2026-108554

Requires an authenticated high-privilege (admin) account able to reach the Settings Handler and invoke sistem.php::simpan in application/modules/admin/controllers/sistem.php, where the Title argument is stored without sanitization (consistent with PR:H). Exploitation further requires a user to subsequently view the page that renders the stored Title, triggering the script (consistent with UI:P). These two factors - prior admin access and the need for a victim to view the injected content - are the primary limiters: because the vulnerable endpoint lives in the admin module, the realistic attacker is an already-privileged operator or someone who has first compromised an admin session, which keeps real-world impact narrow. No non-default configuration is indicated by the available sources; the specific escaping/trigger mechanics beyond the stored Title are not described in the input.

Signals point consistently to a low-to-moderate, non-urgent issue rather than a true priority. The supplied CVSS 4.0 base score is 4.8 (medium) with vector AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N, meaning network-reachable but gated behind high privileges (PR:H) and requiring victim interaction (UI:P), with only low integrity impact and no confidentiality or availability impact. No EPSS score and no CISA KEV listing are present in the input, so there is no evidence of active exploitation or high predicted exploitation probability. The PoC is a reference only (a GitHub issue), not verified as working exploit code, so it should not be treated as a weaponized exploit. The vuln.today decision label is 'this_month', which is a routine-patching cadence, not act_now or emergency. The one internal tension worth flagging: the E:P (Proof-of-Concept exploit maturity) sub-metric and the 'XSS' nature combined with PR:H indicate the attacker must already hold a high-privilege (admin) account to reach the vulnerable Settings Handler, which substantially narrows real-world risk toward an already-trusted operator or a secondary attacker who has first compromised an admin session. Net: a legitimately medium-severity, low-real-risk stored XSS in an obscure product, not a widespread threat.

An attacker who already holds (or has hijacked) a high-privilege admin account submits a crafted <script> payload in the Title field of the Settings Handler (sistem.php::simpan); the value is stored and later rendered unescaped, executing in the browser of an admin who views the settings page. A public PoC reference exists (a GitHub issue report), but it is not verified as working exploit code, and exploitation still requires the privileged access and the victim viewing the injected content described by PR:H and UI:P.