CVE-2026-124448

OpenEMR versions before 8.3.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the CCDA/CCD preview stylesheets . The root cause is that cda.xsl copies event-handler attributes that evade a character denylist, while ccd.xsl copies unsanitized table-cell attributes into t...

EUVD-2026-119552

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into preview HTML. Authenticated users can uplo...

CVE-2026-124448: openemr: OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where…

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into preview HTML. Authenticated users can uplo...