PT-2026-146762

CVE-2026-126477

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description The Eye Exam (eye mag) module contains a stored cross-site scripting issue. This occurs when administrators inject JavaScript through unencoded titles in the Eye defaults list option. An attacker can store a crafted title via the 'edit list.php' endpoint that breaks out of a jQuery string in 'eye base.php', resulting in script execution within the session of any authenticated user who clicks Defaults.

Recommendations Update to version 8.5.0 or later. Restrict access to the 'edit list.php' endpoint to trusted administrators only.

Exploitability

Exploit

Fix

Impacts

Researchers

Milo2012

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers