PT-2026-26334 · Openemr · Openemr

Lassiiiiii · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-33299

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.2

Description OpenEMR is an electronic health records and medical practice management application. A stored cross-site scripting (XSS) issue exists in the function used to display answers from the Eye Exam form. An authenticated attacker with the Notes - my encounters role can inject arbitrary JavaScript code into the system by providing malicious input to the form answers. This injected JavaScript is then executed when other users with the same role view the form answers within patient encounters or visit history. The vulnerable function is responsible for displaying the form answers.

Recommendations Update to OpenEMR version 8.0.0.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-05090

CVE-2026-33299

GHSA-PGVQ-F22Q-2WHP

Affected Products

Openemr

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33299.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-pgvq-f22q-2whp · Vendor Advisory
• https://github.com/openemr/openemr/commit/dccc962f06bdf6105ca85c277915167caf3e7c28 · Patch
• https://bdu.fstec.ru/vul/2026-05090 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33299 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33299 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2034785256797020317 · Twitter Post
• https://twitter.com/CVEnew/status/2036024182199439844 · Twitter Post