CVE-2026-25743

OpenEMR prior to v8.0.0 contains a stored XSS flaw in the questionnaire answer display path. Users with the Forms administration role can submit malicious payloads through form answers, and any user with that role viewing the encounter pages or visit history will execute the injected JavaScript. ...