CVE-2026-126475

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description Authenticated attackers can execute JavaScript by injecting payloads into the searchEleNo POST parameter of the 'application/index/search' endpoint. This occurs because the application fails to encode HTML attributes in auto-suggest.phtml, allowing the injection of event handlers that trigger upon DOM insertion. This can lead to the theft of patient data and non-HttpOnly session cookies.

Recommendations Update to version 8.5.0 or later. Avoid using the searchEleNo parameter in the 'application/index/search' endpoint until the update is applied.