PT-2026-146737

CVE-2026-126451

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 4.0

8.5

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description A stored cross-site scripting issue exists where portal patients can execute JavaScript within staff sessions. This occurs by injecting javascript: URLs into template data. An attacker can submit an encounterForm value that is rendered without sanitization into an iframe src by the DocumentTemplateRender() function. This allows the script to access Protected Health Information (PHI) and CSRF tokens, and to make calls to staff or admin endpoints.

Recommendations Update to version 8.5.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Gracia-Gu

Philipphil

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')