PT-2026-146704
CVE-2026-126418
·
تاريخ النشر
2026-11-13
·
تاريخ التحديث
2026-11-13
الوصف من
CVSS 3.1
6.3
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl eob invoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾