PT-2026-28141 · Openemr · Openemr

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-33911

Mitre

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the POST parameter title is reflected back in a JSON response built with json encode(). Because the response is served with a text/html Content-Type, the browser interprets injected HTML/script tags rather than treating the output as JSON. An authenticated attacker can craft a request that executes arbitrary JavaScript in a victim's session. Version 8.0.0.3 contains a fix.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33911

Affected Products

Openemr

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-33911 · Security Note
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 · Note
• https://github.com/openemr/openemr/commit/64e8befa0a49f85dd5e2a85c91f3f8b9e565896f · Note
• https://github.com/openemr/openemr/security/advisories/GHSA-wwhf-6cvc-6766 · Note