Stored XSS Vulnerability in OpenEMR Affects Users on Eye Exam Forms

CVE-2026-33299

What is CVE-2026-33299?

OpenEMR, the widely-used electronic health records management application, is affected by a stored cross-site scripting (XSS) vulnerability prior to version 8.0.0.2. Users assigned the 'Notes - my encounters' role can maliciously manipulate Eye Exam forms during patient encounters, injecting arbitrary JavaScript into the system. This injected code can be executed by any user with the same role when they access the form answers in the encounter details, posing significant risks to patient data integrity and security. Upgrading to version 8.0.0.2 mitigates this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References