CVE-2026-126427 OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form

OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skiptimeoutreset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since...

EUVD-2026-125016

OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skiptimeoutreset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since...

CVE-2026-126427

OpenEMR versions before 8.5.0 are vulnerable to an idle session timeout bypass via the Eye Exam form. The root cause is that the read-only poll for this form omits skip_timeout_reset, allowing the update_READONLY() function to reset the idle timer every 15 seconds. An attacker with physical acces...

CVE-2026-126462

OpenEMR versions before 8.5.0 are vulnerable to a stored cross-site scripting (XSS) flaw. Authenticated users with Eye Exam edit permissions can inject malicious scripts via the Next Visit Orders PLAN[] field. By storing a payload that closes the textarea in view.php , an attacker can execute Jav...

EUVD-2026-124947

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam eyemag module that allows administrators to inject JavaScript through unencoded Eyedefaults list option titles. Attackers can store a crafted title via editlist.php that breaks out of a jQuery string in...

CVE-2026-126477

OpenEMR before version 8.5.0 is vulnerable to a stored cross-site scripting (XSS) flaw in the Eye Exam (eye_mag) module. The root cause is the failure to encode Eye_defaults list option titles. An administrator can inject JavaScript by storing a crafted title via edit_list.php , which then breaks...

CVE-2026-33348

OpenEMR is a free and open source electronic health records and medical practice management application. Users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with...

CVE-2026-33321

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form can be printed out in PDF form. An Out-of-Band Server-Side...

CVE-2026-33299

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history...

CVE-2026-33348

OpenEMR is a free and open source electronic health records and medical practice management application. Users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with...

CVE-2026-33348 OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3

OpenEMR is a free and open source electronic health records and medical practice management application. Users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with...

CVE-2026-33348

OpenEMR is a free and open source electronic health records and medical practice management application. Users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with...

EUVD-2026-16012

OpenEMR is a free and open source electronic health records and medical practice management application. Users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with...

CVE-2026-33348 OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3

OpenEMR is a free and open source electronic health records and medical practice management application. Users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with...

CVE-2026-33348 OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3

OpenEMR is a free and open source electronic health records and medical practice management application. Users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with...

CVE-2026-33348

OpenEMR has a stored XSS vulnerability in the Eye Exam form answers for the Notes - my encounters role. Versions prior to 8.0.0.3 allow an authenticated attacker with that role to inject arbitrary JavaScript via form answers, which is executed when other users view the form answers on encounter p...

CVE-2026-33348

OpenEMR is a free and open source electronic health records and medical practice management application. Users with the "Notes - my encounters" role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users wi...

CVE-2026-33348: Improper Neutralization of Input During Web Page Generation

OpenEMR is a free and open source electronic health records and medical practice management application. Users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with...

PT-2026-28137

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.3 Description OpenEMR is an electronic health records and medical practice management application. A stored cross-site scripting XSS issue exists in the function responsible for displaying form answers. An...

CVE-2026-33321

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form can be printed out in PDF form. An Out-of-Band Server-Side...