CVE-2026-103935

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An authenticated clinical user can inject event-handler markup by storing values containing double quotes. This occurs because the text() function uses ENT NOQUOTES when rendering stored transfer to, code, and codetext values within double-quoted HTML value attributes at the 'interface/forms/transfer summary/new.php' and 'interface/forms/functional cognitive status/new.php' endpoints. Successful exploitation can expose session data and protected health information or allow unauthorized patient-record actions within the victim's session.

Recommendations Update to version 8.3.0.