CVE-2026-124452

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description Authenticated users with document-note write access can perform a stored cross-site scripting attack via the 'interface/forms/eye mag/report.php' endpoint. By adding unescaped document notes, an attacker can store malicious JavaScript within a retina document note. This script executes when clinicians generate the Eye Exam patient report, which can lead to the exposure of session cookies.

Recommendations Update to version 8.3.0 or later.