CVE-2026-124452 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 does not escape document notes shown in the Eye Exam patient report, so a stored script in a retina note runs when a clinician generates the report. An attacker who can write document notes can capture the clinician's session cookies.
first public Aug 18, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clinics and hospitals running self-hosted OpenEMR before 8.3.0 where staff can add document notes that clinicians later open in the Eye Exam report. Installations on 8.3.0 or later, or where only trusted staff can write document notes, carry less exposure. The sources do not say whether the flaw is reachable without an account.
Not affected if no-document-note-write-access, openemr-8.3.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.3.0 are in range.8.3.0 or later, per the sources.OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note that executes when clinicians generate the Eye Exam patient report, exposing session cookies.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.