PT-2026-28137 · Openemr · Openemr

Publicado 2026-03-25 · Atualizado 2026-04-26 · CVE-2026-33348

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.3

Description OpenEMR is an electronic health records and medical practice management application. A stored cross-site scripting (XSS) issue exists in the function responsible for displaying form answers. An authenticated attacker with the Notes - my encounters role can inject arbitrary JavaScript into the system by providing malicious input to the form answers. This injected JavaScript is then executed when other users with the same role view the form answers in patient encounter pages or visit history. The vulnerability affects the Eye Exam forms within patient encounters.

Recommendations Versions prior to 8.0.0.3 should be updated to version 8.0.0.3 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-33348

GHSA-6CH2-P26G-X33H

Produtos afetados

Openemr

Referências · 10

• 🔥 https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33348.json · Exploit
• https://github.com/openemr/openemr/commit/f488efbe3eb7f17d0f057f960020cb611149f8a2 · Correção
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 · Nota
• https://twitter.com/TheHackerWire/status/2036946229436072013 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2036951998038266086 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33348 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037137793919447165 · Publicação no Twitter
• https://twitter.com/integ_sec/status/2048375306256294102 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33348 · Aviso do Fabricante