Cross-Site Scripting in OpenEMR Affects Health Records Management

CVE-2026-103935

What is CVE-2026-103935?

OpenEMR, an open-source electronic health records and medical practice management application, has a vulnerability that allows an authenticated user to exploit specific forms due to improper handling of input data. Prior to version 8.3.0, certain values rendered in double-quoted HTML attributes could be manipulated by injecting malicious event-handler markup. This exploitation can lead to exposure of sensitive session data, protected health information, and allow unauthorized actions on patient records. Users should upgrade to version 8.3.0 or later to mitigate this risk.

References