PT-2026-26345 · Openemr · Openemr

Lassiiiiii + 2 · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-33303

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.2

Description OpenEMR is a free and open source electronic health records and medical practice management application. The application is susceptible to a stored cross-site scripting (XSS) issue. This occurs due to unescaped portal login username within the portal credential print view. A patient portal user can inject an XSS payload as their login username, which then executes in a clinic staff member's browser when the "Create Portal Login" page is accessed for that patient. This allows for a transition from the patient session context to the staff/admin session context.

Recommendations Versions prior to 8.0.0.2 should be updated to version 8.0.0.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-05091

CVE-2026-33303

GHSA-CP37-PMFX-5MHM

Affected Products

Openemr

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33303.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-cp37-pmfx-5mhm · Vendor Advisory
• https://github.com/openemr/openemr/commit/c32139b5144b1c704015221520ad2f931e25f10d · Patch
• https://bdu.fstec.ru/vul/2026-05091 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33303 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33303 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2034777577114440009 · Twitter Post
• https://twitter.com/CVEnew/status/2035992550461288872 · Twitter Post
• https://twitter.com/infoflowcloud/status/2035994017154949384 · Twitter Post