CVE-2026-126418OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php

Beschreibung

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-v7qh-q4xq-28v3) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php third-party-advisory