Stored Cross-Site Scripting Vulnerability in OpenEMR by OpenEMR
CVE-2026-124452

5.1MEDIUM

Key Information:

Vendor

Openemr

Status
Openemr
Vendor
CVE Published:
8 November 2026

What is CVE-2026-124452?

OpenEMR versions prior to 8.3.0 are susceptible to a stored cross-site scripting vulnerability found in the Eye Exam report section. This security flaw enables authenticated users with the capability to add document notes to inject malicious scripts. When healthcare professionals generate Eye Exam patient reports, these scripts can execute, compromising session cookies and potentially leading to unauthorized access to sensitive information.

Affected Version(s)

openemr 0 < 8.3.0

openemr 8.3.0

References

https://github.com/openemr/openemr/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/openemr-before-8.3.0...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lyethar
tonghuaroot
.