CVE-2026-126424

OpenEMR versions before 8.5.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability exists because users with admin or superbill write permissions can inject malicious HTML into SNOMED code descriptions through the superbill_custom_full.php component. When a clinician sele...