CVE-2026-126424

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write permission to inject HTML into SNOMED code descriptions via superbillcustomfull.php. When a clinician selects the malicious code, the Functional and Cognitive Status form or...