CVE-2026-126476 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 echoes the searchMode POST parameter unencoded into an onClick attribute in the Application module's auto-suggest endpoint. An attacker who tricks a logged-in user into submitting a crafted search can run JavaScript in that user's session to steal session cookies or view patient data.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and organisations running self-hosted OpenEMR older than 8.5.0 where staff are logged in and can be lured to a malicious link or page. Exposure depends on the Application module's auto-suggest endpoint being reachable by authenticated users. Instances already on 8.5.0 or later are not affected.
Not affected if no-authenticated-users, version-8.5.0-or-later
Who cares healthcare, openemr, self-hosted
8.5.0 are listed as affected.application/index/search containing single-quote characters in searchMode.8.5.0 or later.OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.