CVE-2026-126475 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 reflects the searchEleNo POST parameter into an unencoded HTML attribute in auto-suggest.phtml, so a crafted payload runs JavaScript in the browser of a logged-in user. An attacker can use this to steal non-HttpOnly session cookies and view patient data.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and organizations that run OpenEMR themselves before version 8.5.0 are exposed, because the flaw is in the search endpoint of the application. The attacker must have a logged-in account, so exposure depends on who can sign in to the instance. Hosted deployments the vendor manages are handled by the vendor.
Not affected if managed-hosting, version-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
composer.json and compare it with 8.5.0.searchEleNo parameter handling in application/index/search and auto-suggest.phtml in the deployed code.8.5.0 or later.OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by injecting payloads into the searchEleNo POST parameter of the application/index/search endpoint. Attackers can break out of unencoded HTML attributes in auto-suggest.phtml to inject event handlers that fire on DOM insertion, stealing non-HttpOnly session cookies and patient data.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.