The HospitalManagement application is vulnerable to a remote reflected cross‑site scripting flaw. The function sistem.php::simpan accepts a Title parameter that is rendered without proper sanitization, allowing attackers to inject arbitrary HTML or JavaScript into the page. This vulnerability aligns with CWE‑79 and CWE‑94, enabling clients to send malicious payloads that execute in the victim’s browser. The impact includes defacement, credential theft, or arbitrary code execution within the context of the authenticated user.

All releases of the gedelumbung HospitalManagement product up to commit c2d4554 are affected. The project follows a rolling‑release model, so none of the released versions at the time of this advisory have a known fix. Administrators should consider that any deployed instance, regardless of minor version number, may be vulnerable unless the source code has been patched manually.

The CVSS score is 4.8, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but publicly available exploit code exists and could be executed remotely. Given the remote nature of the attack vector and the lack of a published patch, the risk remains elevated for exposed deployments, especially those reachable from the public internet.