Stored XSS Vulnerability in OpenEMR Affects Patient Portal Logins

CVE-2026-33303

What is CVE-2026-33303?

A vulnerability exists in OpenEMR prior to version 8.0.0.2, allowing stored cross-site scripting (XSS) through the portal_login_username field. An attacker can exploit this by setting their login username to an XSS payload. This payload executes in the browser of clinic staff when they access the 'Create Portal Login' page for the affected patient, thereby damaging the security of the patient and clinic's web sessions. The latest version, 8.0.0.2, addresses this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References