CVE-2026-126476

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description A reflected cross-site scripting issue exists in the Application module's auto-suggest endpoint. The endpoint application/index/search echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. This allows an attacker to execute arbitrary JavaScript in the session of an authenticated user by inducing them to submit a specific payload, potentially leading to the theft of session cookies or the disclosure of patient data.

Recommendations Update to version 8.5.0 or later. Avoid using the searchMode parameter in the application/index/search endpoint until the update is applied.