CVE-2026-124448

OpenEMR versions before 8.3.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the CCDA/CCD preview stylesheets . The root cause is that cda.xsl copies event-handler attributes that evade a character denylist, while ccd.xsl copies unsanitized table-cell attributes into t...