CVE-2026-126484 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 does not escape appointment comments shown on printed fee sheets. A logged-in patient can store script in those comments, which runs in the browser of staff who open the patient's fee sheet, acting within the staff session.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and practices that run OpenEMR with the patient portal enabled, where patients can add appointment comments. Staff who open printed fee sheets are the victims. Installations on 8.5.0 or later, or without patient portal accounts, are not exposed per the sources.
Not affected if no-patient-portal, version-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.5.0 are exposed.8.5.0 or later.OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pc_hometext). Attackers can submit HTML payloads via the form_comments field in add_edit_event_user.php that execute when staff open the patient's fee sheet, acting within the staff session.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.