CVE-2026-126418OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php

Açıklama

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-v7qh-q4xq-28v3) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php third-party-advisory