---
id: "CVE-2026-126462"
page: "https://infrastack.ai/live/CVE-2026-126462"
kind: "vulnerability"
aliases: ["CVE-2026-126462"]
title: "OpenEMR: stored script injection in Eye Exam orders steals sessions"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["healthcare", "openemr", "other", "self-hosted"]
not_affected_if: ["no-eye-exam-edit-permission", "version-8.5.0-or-later"]
published_at: "2026-11-13T10:17:54+00:00"
first_seen_at: "2026-11-13T10:47:24+00:00"
updated_at: "2026-11-13T10:56:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126462", "first_seen_at": "2026-11-13T10:47:24+00:00"}]
exploit_sources: []
---

# OpenEMR: stored script injection in Eye Exam orders steals sessions

Link for people: https://infrastack.ai/live/CVE-2026-126462 (this .md is for agents)

OpenEMR before 8.5.0 lets a logged-in user with Eye Exam edit permission store a script in the Next Visit Orders PLAN field. The script runs in the browser of another user who opens the Eye Exam editor, which can steal session identifiers or clinical data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenEMR version in use; `8.5.0` or later is not affected by this entry.

## Fix

- OpenEMR: move to `8.5.0` or later.

## Timeline

- 2026-11-13T10:47:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126462

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openemr/openemr/security/advisories/GHSA-rgv4-6mf9-hxwx
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-eye-exam-next-visit-orders

## From the sources

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam edit permission to inject scripts via the Next Visit Orders PLAN[] field. Attackers can store a payload closing the textarea in view.php, executing JavaScript when another user opens the Eye Exam editor to steal session identifiers or clinical data.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_