{"id":"CVE-2026-126462","kind":"vulnerability","aliases":["CVE-2026-126462"],"related":[],"title":"OpenEMR: stored script injection in Eye Exam orders steals sessions","description":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam edit permission to inject scripts via the Next Visit Orders PLAN[] field. Attackers can store a payload closing the textarea in view.php, executing JavaScript when another user opens the Eye Exam editor to steal session identifiers or clinical data.","summary":"OpenEMR before 8.5.0 lets a logged-in user with Eye Exam edit permission store a script in the Next Visit Orders PLAN field. The script runs in the browser of another user who opens the Eye Exam editor, which can steal session identifiers or clinical data.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","other","self-hosted"],"not_affected_if":["no-eye-exam-edit-permission","version-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in use; `8.5.0` or later is not affected by this entry.","fix":"- OpenEMR: move to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:54+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","triaged_at":"2026-11-13T10:56:54+00:00","updated_at":"2026-11-13T10:56:54+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:56:54Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: move to `8.5.0` or later.","reach":"network","title":"OpenEMR: stored script injection in Eye Exam orders steals sessions","impact":"medium","summary":"OpenEMR before 8.5.0 lets a logged-in user with Eye Exam edit permission store a script in the Next Visit Orders PLAN field. The script runs in the browser of another user who opens the Eye Exam editor, which can steal session identifiers or clinical data.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openemr","self-hosted","healthcare"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Other users' session identifiers and clinical data can be stolen","analyst_note":"","how_to_check":"- Check the OpenEMR version in use; `8.5.0` or later is not affected by this entry.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later","no-eye-exam-edit-permission"],"who_is_affected":"Clinics and practices that run OpenEMR themselves and give staff Eye Exam edit permission. Users who cannot edit Eye Exam records cannot inject the script, and hosted deployments depend on the vendor's patching.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000709,"input_tokens":4628,"output_tokens":492,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126462':13A,16A '-2026':12A,15A '8.5.0':25B,72C 'allow':82C 'anoth':54B,113C 'attack':100C 'authent':83C 'browser':52B 'clinic':68B,125C 'close':105C 'contain':73C 'cross':77C 'cross-sit':76C 'cve':11A,14A 'data':69B,126C 'edit':35B,88C 'editor':61B,119C 'exam':7A,34B,60B,87C,118C 'execut':110C 'eye':6A,33B,59B,86C,117C 'field':46B,99C 'healthcar':17B 'host':22B 'identifi':66B,123C 'inject':4A,91C 'javascript':111C 'let':26B 'log':29B 'logged-in':28B 'next':42B,95C 'open':57B,115C 'openemr':1A,18B,23B,70C 'order':8A,44B,97C 'payload':104C 'permiss':36B,89C 'plan':45B,98C 'run':49B 'script':3A,39B,48B,79C,92C 'self':21B 'self-host':20B 'session':10A,65B,122C 'site':78C 'steal':9A,64B,121C 'store':2A,37B,75C,102C 'textarea':107C 'user':31B,55B,84C,114C 'via':93C 'view.php':109C 'visit':43B,96C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Clinics and practices that run OpenEMR themselves and give staff Eye Exam edit permission. Users who cannot edit Eye Exam records cannot inject the script, and hosted deployments depend on the vendor's patching.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","other","selfhosted"],"campaign_type":null,"search_a":"'-126462':13A,16A '-2026':12A,15A 'cve':11A,14A 'exam':7A 'eye':6A 'inject':4A 'openemr':1A 'order':8A 'script':3A 'session':10A 'steal':9A 'store':2A","search_b":"'8.5.0':25B 'anoth':54B 'browser':52B 'clinic':68B 'data':69B 'edit':35B 'editor':61B 'exam':34B,60B 'eye':33B,59B 'field':46B 'healthcar':17B 'host':22B 'identifi':66B 'let':26B 'log':29B 'logged-in':28B 'next':42B 'open':57B 'openemr':18B,23B 'order':44B 'permiss':36B 'plan':45B 'run':49B 'script':39B,48B 'self':21B 'self-host':20B 'session':65B 'steal':64B 'store':37B 'user':31B,55B 'visit':43B","search_c":"'8.5.0':72C 'allow':82C 'anoth':113C 'attack':100C 'authent':83C 'clinic':125C 'close':105C 'contain':73C 'cross':77C 'cross-sit':76C 'data':126C 'edit':88C 'editor':119C 'exam':87C,118C 'execut':110C 'eye':86C,117C 'field':99C 'identifi':123C 'inject':91C 'javascript':111C 'next':95C 'open':115C 'openemr':70C 'order':97C 'payload':104C 'permiss':89C 'plan':98C 'script':79C,92C 'session':122C 'site':78C 'steal':121C 'store':75C,102C 'textarea':107C 'user':84C,114C 'via':93C 'view.php':109C 'visit':96C 'vulner':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:29:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126462","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126462","severity":null,"published_at":"2026-11-13T10:17:54+00:00","modified_at":"2026-11-13T10:17:54+00:00","first_seen_at":"2026-11-13T10:47:24+00:00","fetched_at":"2026-11-13T10:47:24+00:00","note":null}],"documents":[{"id":145167,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-rgv4-6mf9-hxwx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:29:16+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145168,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-eye-exam-next-visit-orders","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}