Cross-site Scripting Vulnerability in OpenEMR by OpenEMR

CVE-2026-33911

What is CVE-2026-33911?

OpenEMR, a widely used electronic health records and medical management application, contains a vulnerability where the title POST parameter is reflected in a JSON response. Due to the incorrect handling of the Content-Type as text/html, browsers process any injected HTML or script tags, leading to potential unauthorized JavaScript execution in the context of authenticated user sessions. This could allow an attacker to manipulate user sessions or access sensitive information. The issue is resolved in version 8.0.0.3, emphasizing the importance of keeping software updated.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References