{"id":"CVE-2026-124452","kind":"vulnerability","aliases":["CVE-2026-124452"],"related":[],"title":"OpenEMR: stored script injection in eye exam report steals clinician sessions","description":"OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note that executes when clinicians generate the Eye Exam patient report, exposing session cookies.","summary":"OpenEMR before 8.3.0 does not escape document notes shown in the Eye Exam patient report, so a stored script in a retina note runs when a clinician generates the report. An attacker who can write document notes can capture the clinician's session cookies.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","php","self-hosted"],"not_affected_if":["no-document-note-write-access","openemr-8.3.0-or-later"],"how_to_check":"- Check the installed OpenEMR version; versions below `8.3.0` are in range.\n- Review who holds document-note write access in the OpenEMR install.","fix":"- OpenEMR: `8.3.0` or later, per the sources.","status":"open","published_at":"2026-11-08T14:18:12+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:50:57+00:00","updated_at":"2026-11-08T14:50:57+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-08T14:50:57Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: `8.3.0` or later, per the sources.","reach":"network","title":"OpenEMR: stored script injection in eye exam report steals clinician sessions","impact":"medium","summary":"OpenEMR before 8.3.0 does not escape document notes shown in the Eye Exam patient report, so a stored script in a retina note runs when a clinician generates the report. An attacker who can write document notes can capture the clinician's session cookies.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"clinician session cookies stolen via script run in their browser","analyst_note":"","how_to_check":"- Check the installed OpenEMR version; versions below `8.3.0` are in range.\n- Review who holds document-note write access in the OpenEMR install.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["openemr-8.3.0-or-later","no-document-note-write-access"],"who_is_affected":"Clinics and hospitals running self-hosted OpenEMR before 8.3.0 where staff can add document notes that clinicians later open in the Eye Exam report. Installations on 8.3.0 or later, or where only trusted staff can write document notes, carry less exposure. The sources do not say whether the flaw is reachable without an account.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000736,"input_tokens":4631,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124452':14A,17A '-2026':13A,16A '8.3.0':27B,71C 'access':100C 'add':90C 'allow':83C 'attack':56B,94C 'authent':84C 'captur':63B 'clinician':10A,51B,65B,113C 'contain':72C 'cooki':68B,122C 'cross':76C 'cross-sit':75C 'cve':12A,15A 'document':31B,60B,92C,97C,108C 'document-not':96C 'escap':30B 'exam':7A,37B,117C 'execut':111C 'expos':120C 'eye':6A,36B,116C 'generat':52B,114C 'healthcar':18B 'host':24B 'inject':4A,87C 'interface/forms/eye_mag/report.php':81C 'javascript':104C 'malici':103C 'note':32B,47B,61B,93C,98C,109C 'openemr':1A,19B,25B,69C 'patient':38B,118C 'php':21B 'report':8A,39B,54B,119C 'retina':46B,107C 'run':48B 'script':3A,43B,78C,88C 'self':23B 'self-host':22B 'session':11A,67B,121C 'shown':33B 'site':77C 'steal':9A 'store':2A,42B,74C,102C 'unescap':91C 'user':85C 'vulner':79C 'write':59B,99C","nicknames":[],"mitigations":[],"who_affected":"Clinics and hospitals running self-hosted OpenEMR before 8.3.0 where staff can add document notes that clinicians later open in the Eye Exam report. Installations on 8.3.0 or later, or where only trusted staff can write document notes, carry less exposure. The sources do not say whether the flaw is reachable without an account.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","other","php","selfhosted"],"campaign_type":null,"search_a":"'-124452':14A,17A '-2026':13A,16A 'clinician':10A 'cve':12A,15A 'exam':7A 'eye':6A 'inject':4A 'openemr':1A 'report':8A 'script':3A 'session':11A 'steal':9A 'store':2A","search_b":"'8.3.0':27B 'attack':56B 'captur':63B 'clinician':51B,65B 'cooki':68B 'document':31B,60B 'escap':30B 'exam':37B 'eye':36B 'generat':52B 'healthcar':18B 'host':24B 'note':32B,47B,61B 'openemr':19B,25B 'patient':38B 'php':21B 'report':39B,54B 'retina':46B 'run':48B 'script':43B 'self':23B 'self-host':22B 'session':67B 'shown':33B 'store':42B 'write':59B","search_c":"'8.3.0':71C 'access':100C 'add':90C 'allow':83C 'attack':94C 'authent':84C 'clinician':113C 'contain':72C 'cooki':122C 'cross':76C 'cross-sit':75C 'document':92C,97C,108C 'document-not':96C 'exam':117C 'execut':111C 'expos':120C 'eye':116C 'generat':114C 'inject':87C 'interface/forms/eye_mag/report.php':81C 'javascript':104C 'malici':103C 'note':93C,98C,109C 'openemr':69C 'patient':118C 'report':119C 'retina':107C 'script':78C,88C 'session':121C 'site':77C 'store':74C,102C 'unescap':91C 'user':85C 'vulner':79C 'write':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-18T08:44:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124452","severity":null,"published_at":"2026-11-08T14:18:12+00:00","modified_at":"2026-11-08T14:18:12+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102089,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-xwjf-6q28-9vj7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T08:44:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102090,"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-stored-xss-via-eye-exam-document-notes","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}