Lassiiiiii

OpenEMR is an electronic health records and medical practice management application. A stored cross-site scripting (XSS) issue exists in the function used to display answers from the **Eye Exam** form. An authenticated attacker with the `Notes - my encounters` role can inject arbitrary JavaScript code into the system by providing malicious input to the form answers. This injected JavaScript is then executed when other users with the same role view the form answers within patient encounters or visit history. The vulnerable function is responsible for displaying the form answers.

OpenEMR is an electronic health records and medical practice management application. A file read issue exists in the PDF creation function when processing form answers as unescaped HTML. This allows an attacker to include arbitrary image files from the server in generated PDFs. The issue affects users with the `Notes - my encounters` role who can fill Eye Exam forms in patient encounters. The vulnerability is triggered when parsing form answers, potentially leading to unauthorized access to server files. The vulnerable function processes the form answers without proper sanitization.

OpenEMR is an electronic health records and medical practice management application. A Server-Side Request Forgery (SSRF) issue exists in the PDF creation function when processing form answers as unescaped HTML. This allows an attacker to forge requests from the server to external or internal resources. The issue affects users with the `Notes - my encounters` role who can fill Eye Exam forms in patient encounters. The vulnerability is triggered when the form answers are parsed as unescaped HTML during PDF creation. The vulnerable function is involved in processing form data for PDF generation.

OpenEMR is a free and open source electronic health records and medical practice management application. The application is susceptible to a stored cross-site scripting (XSS) issue. This occurs due to unescaped `portal login username` within the portal credential print view. A patient portal user can inject an XSS payload as their login username, which then executes in a clinic staff member's browser when the "Create Portal Login" page is accessed for that patient. This allows for a transition from the patient session context to the staff/admin session context.

OpenEMR é um aplicativo de registros eletrônicos de saúde e gestão de consultórios médicos. Existe uma vulnerabilidade de cross-site scripting (XSS) armazenado na função responsável por exibir respostas de formulários. Um invasor autenticado com a função "Administração de formulários" pode injetar código JavaScript arbitrário no sistema ao fornecer entradas maliciosas nas respostas de formulários. O código injetado é então executado quando outros usuários com a mesma função visualizam as respostas dos formulários nas páginas de atendimento do paciente ou no histórico de visitas. A função vulnerável é a responsável por exibir as respostas dos formulários.