Reflected XSS Vulnerability in OpenEMR Electronic Health Records Software
CVE-2026-33933
What is CVE-2026-33933?
OpenEMR, a widely-used open-source electronic health records and medical practice management application, is affected by a reflected cross-site scripting (XSS) vulnerability found in the custom template editor. This vulnerability allows attackers to inject and execute arbitrary JavaScript code in the web browsers of authenticated staff members without requiring an OpenEMR account. The issue exists in versions 7.0.2.1 and earlier up until version 8.0.0.3, which has successfully addressed this security concern. Organizations utilizing affected versions are strongly encouraged to update to version 8.0.0.3 or later to mitigate potential security risks.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
openemr >= 7.0.2.1, < 8.0.0.3