CVE-2026-124463 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.3.0 lets a logged-in user with CAMOS access save HTML through ajax_save.php that is later printed unencoded by rx_print.php. A victim who opens the entry runs the attacker's script, which can act and read data as that user.
first public Aug 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Deployments of OpenEMR before 8.3.0 where users have CAMOS access can be exposed, since stored script in CAMOS content runs when printed through the non-print_html branch of rx_print.php. Attackers need an authenticated account with CAMOS access. Deployments already on 8.3.0 or later are not affected.
Not affected if no-camos-access, version-8.3.0-or-later
Who cares healthcare, openemr, self-hosted
8.3.0 are in the described range.8.3.0 or later.OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content through ajax_save.php. Attackers can store a script payload that executes unencoded when the entry is printed via the non-print_html branch of rx_print.php, performing actions and reading data as the victim user.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.