{"id":"CVE-2026-126418","kind":"vulnerability","aliases":["CVE-2026-126418"],"related":[],"title":"OpenEMR: stored script injection via billing codes exposes patient data","description":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user.","summary":"OpenEMR before 8.5.0 fails to escape billing codes inside a JavaScript handler on the EOB invoice page. A clinician with coding access can save crafted billing codes that run script in the browser of a Back Office user who enters a payment, exposing patient and financial data or acting as that user.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenEMR","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["healthcare","openemr","other","php","self-hosted"],"not_affected_if":["openemr-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version; the sources say versions before `8.5.0` are affected.\n- Review `interface/billing/sl_eob_invoice.php` in the deployed code for the `onkeyup` handler, per the sources (unknown whether this is the exact check).","fix":"- Move to OpenEMR `8.5.0` or later, per the sources.","status":"open","published_at":"2026-11-13T10:17:47+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","triaged_at":"2026-11-13T10:54:43+00:00","updated_at":"2026-11-13T10:54:43+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T10:54:43Z","model":"claude-haiku-5-5","output":{"fix":"- Move to OpenEMR `8.5.0` or later, per the sources.","reach":"network","title":"OpenEMR: stored script injection via billing codes exposes patient data","impact":"medium","summary":"OpenEMR before 8.5.0 fails to escape billing codes inside a JavaScript handler on the EOB invoice page. A clinician with coding access can save crafted billing codes that run script in the browser of a Back Office user who enters a payment, exposing patient and financial data or acting as that user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"script runs as a back office user, exposing patient and financial data","analyst_note":"","how_to_check":"- Check the installed OpenEMR version; the sources say versions before `8.5.0` are affected.\n- Review `interface/billing/sl_eob_invoice.php` in the deployed code for the `onkeyup` handler, per the sources (unknown whether this is the exact check).","plain_action":"","product_name":"OpenEMR","needs_analyst":false,"not_affected_if":["openemr-8.5.0-or-later"],"who_is_affected":"Clinics and hospitals running OpenEMR before 8.5.0 where users have encounter coding access and Back Office users record payments. The flaw needs a clinician with coding rights to plant the payload, and a Back Office user to trigger it. Installations already on 8.5.0 or later are not affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00076,"input_tokens":4657,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126418':13A,16A '-2026':12A,15A '8.5.0':27B,79C 'access':46B,111C 'act':73B 'action':137C 'attribut':96C 'back':60B,124C 'bill':6A,31B,50B,92C,115C 'browser':57B 'clinician':43B,107C 'code':7A,32B,45B,51B,93C,110C,116C 'contain':80C 'craft':49B,114C 'cross':84C 'cross-sit':83C 'cve':11A,14A 'data':10A,71B,134C 'diagnosis.php':118C 'encount':109C 'enter':64B,127C 'eob':39B 'escap':30B,91C 'execut':120C 'expos':8A,67B,130C 'fail':28B 'financi':70B,133C 'handler':36B,106C 'healthcar':18B 'host':24B 'html':95C 'inject':4A 'inlin':104C 'insid':33B 'interface/billing/sl_eob_invoice.php':89C 'invoic':40B 'javascript':35B,100C 'offic':61B,125C 'onkeyup':105C 'openemr':1A,17A,19B,25B,77C 'page':41B 'patient':9A,68B,131C 'payment':66B,129C 'perform':136C 'php':21B 'run':53B 'save':48B,113C 'script':3A,54B,86C,121C 'self':23B 'self-host':22B 'site':85C 'store':2A,82C 'string':101C 'user':62B,76B,126C,140C 'via':5A 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Clinics and hospitals running OpenEMR before 8.5.0 where users have encounter coding access and Back Office users record payments. The flaw needs a clinician with coding rights to plant the payload, and a Back Office user to trigger it. Installations already on 8.5.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["openemr"],"ptokens":["openemr"],"labels":["healthcare","medium","openemr","other","php","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126418':13A,16A '-2026':12A,15A 'bill':6A 'code':7A 'cve':11A,14A 'data':10A 'expos':8A 'inject':4A 'openemr':1A,17A 'patient':9A 'script':3A 'store':2A 'via':5A","search_b":"'8.5.0':27B 'access':46B 'act':73B 'back':60B 'bill':31B,50B 'browser':57B 'clinician':43B 'code':32B,45B,51B 'craft':49B 'data':71B 'enter':64B 'eob':39B 'escap':30B 'expos':67B 'fail':28B 'financi':70B 'handler':36B 'healthcar':18B 'host':24B 'insid':33B 'invoic':40B 'javascript':35B 'offic':61B 'openemr':19B,25B 'page':41B 'patient':68B 'payment':66B 'php':21B 'run':53B 'save':48B 'script':54B 'self':23B 'self-host':22B 'user':62B,76B","search_c":"'8.5.0':79C 'access':111C 'action':137C 'attribut':96C 'back':124C 'bill':92C,115C 'clinician':107C 'code':93C,110C,116C 'contain':80C 'craft':114C 'cross':84C 'cross-sit':83C 'data':134C 'diagnosis.php':118C 'encount':109C 'enter':127C 'escap':91C 'execut':120C 'expos':130C 'financi':133C 'handler':106C 'html':95C 'inlin':104C 'interface/billing/sl_eob_invoice.php':89C 'javascript':100C 'offic':125C 'onkeyup':105C 'openemr':77C 'patient':131C 'payment':129C 'perform':136C 'save':113C 'script':86C,121C 'site':85C 'store':82C 'string':101C 'user':126C,140C 'vulner':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T02:17:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126418","severity":null,"published_at":"2026-11-13T10:17:47+00:00","modified_at":"2026-11-13T10:17:47+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","fetched_at":"2026-11-13T10:47:20+00:00","note":null}],"documents":[{"id":145079,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-v7qh-q4xq-28v3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T02:17:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145080,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-billing-code-in-sl-eob-invoice-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}