PT-2026-26334 · Openemr · Openemr

Lassiiiiii · Publicado 2026-03-19 · Atualizado 2026-03-23 · CVE-2026-33299

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.2

Description OpenEMR is an electronic health records and medical practice management application. A stored cross-site scripting (XSS) issue exists in the function used to display answers from the Eye Exam form. An authenticated attacker with the Notes - my encounters role can inject arbitrary JavaScript code into the system by providing malicious input to the form answers. This injected JavaScript is then executed when other users with the same role view the form answers within patient encounters or visit history. The vulnerable function is responsible for displaying the form answers.

Recommendations Update to OpenEMR version 8.0.0.2 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2026-05090

CVE-2026-33299

GHSA-PGVQ-F22Q-2WHP

Produtos afetados

Openemr

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33299.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-pgvq-f22q-2whp · Aviso do Fabricante
• https://github.com/openemr/openemr/commit/dccc962f06bdf6105ca85c277915167caf3e7c28 · Correção
• https://twitter.com/VulmonFeeds/status/2034785256797020317 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2036024182199439844 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-05090 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-33299 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33299 · Aviso do Fabricante