PT-2026-28137 · Openemr · Openemr

Published 2026-03-25 · Updated 2026-04-26 · CVE-2026-33348

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.3

Description OpenEMR is an electronic health records and medical practice management application. A stored cross-site scripting (XSS) issue exists in the function responsible for displaying form answers. An authenticated attacker with the Notes - my encounters role can inject arbitrary JavaScript into the system by providing malicious input to the form answers. This injected JavaScript is then executed when other users with the same role view the form answers in patient encounter pages or visit history. The vulnerability affects the Eye Exam forms within patient encounters.

Recommendations Versions prior to 8.0.0.3 should be updated to version 8.0.0.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33348

GHSA-6CH2-P26G-X33H

Affected Products

Openemr

References · 10

• 🔥 https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33348.json · Exploit
• https://github.com/openemr/openemr/commit/f488efbe3eb7f17d0f057f960020cb611149f8a2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33348 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33348 · Vendor Advisory
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 · Note
• https://twitter.com/TheHackerWire/status/2036946229436072013 · Twitter Post
• https://twitter.com/CveFindCom/status/2036951998038266086 · Twitter Post
• https://twitter.com/CVEnew/status/2037137793919447165 · Twitter Post
• https://twitter.com/integ_sec/status/2048375306256294102 · Twitter Post