CVE-2026-126424OpenEMR before 8.5.0 Stored XSS via Billing Code Descriptions

Açıklama

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write permission to inject HTML into SNOMED code descriptions via superbill_custom_full.php. When a clinician selects the malicious code, the Functional and Cognitive Status form or fee-sheet forms assign it to innerHTML, executing JavaScript in the clinician's session to read patient data and perform actions.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-qv97-cvw6-8j53) vendor-advisory
• VulnCheck Advisory: OpenEMR before 8.5.0 Stored XSS via Billing Code Descriptions third-party-advisory