CVE-2026-126418OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php

Descripción

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-v7qh-q4xq-28v3) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php third-party-advisory