CVE-2026-126462 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 lets a logged-in user with Eye Exam edit permission store a script in the Next Visit Orders PLAN field. The script runs in the browser of another user who opens the Eye Exam editor, which can steal session identifiers or clinical data.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and practices that run OpenEMR themselves and give staff Eye Exam edit permission. Users who cannot edit Eye Exam records cannot inject the script, and hosted deployments depend on the vendor's patching.
Not affected if no-eye-exam-edit-permission, version-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 or later is not affected by this entry.8.5.0 or later.OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam edit permission to inject scripts via the Next Visit Orders PLAN[] field. Attackers can store a payload closing the textarea in view.php, executing JavaScript when another user opens the Eye Exam editor to steal session identifiers or clinical data.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.