PT-2026-28141 · Openemr · Openemr

Published 2026-03-25 · Updated 2026-03-26 · CVE-2026-33911

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.3

Description OpenEMR is an electronic health records and medical practice management application. Prior to version 8.0.0.3, the title POST parameter is reflected in a JSON response created using json encode(). Due to the response being served with a text/html Content-Type, browsers interpret injected HTML/script tags instead of treating the output as JSON. An authenticated attacker can construct a request to execute arbitrary JavaScript within a victim’s session. The vulnerable parameter is title.

Recommendations Update to version 8.0.0.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33911

GHSA-WWHF-6CVC-6766

Affected Products

Openemr

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33911.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-wwhf-6cvc-6766 · Vendor Advisory
• https://github.com/openemr/openemr/commit/64e8befa0a49f85dd5e2a85c91f3f8b9e565896f · Patch
• https://osv.dev/vulnerability/CVE-2026-33911 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33911 · Security Note
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 · Note
• https://twitter.com/CVEnew/status/2037137789750329734 · Twitter Post