Stored XSS Vulnerability in OpenEMR Affects Patient Encounter Forms

CVE-2026-33348

What is CVE-2026-33348?

OpenEMR, an open-source electronic health records and medical practice management application, is susceptible to a stored cross-site scripting (XSS) vulnerability. This issue arises due to improper handling of form inputs in the Notes - my encounters role, specifically when users fill out Eye Exam forms. Attackers with this role can input malicious JavaScript code into the responses, which is subsequently displayed on the encounter pages and visit history for all users with the same role. This vulnerability is patched in version 8.0.0.3, which addresses the insecure functionality allowing arbitrary code execution when displaying form results.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References