EUVD-2026-124980

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by placing payloads in the patient External ID field. The payload executes when other users open the patient's prescriptions via View Printable Version HTML, running script ...

CVE-2026-126450

OpenEMR versions before 8.5.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. An authenticated user can inject malicious scripts by placing payloads into the patient External ID field. These scripts execute in the browser sessions of other users who access the patient's presc...