CVE-2026-124452

OpenEMR versions prior to 8.3.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability located in interface/forms/eye_mag/report.php. The root cause is the application's failure to escape document notes, allowing authenticated users with write access to inject malicious JavaScript in...

EUVD-2026-119510

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...

CVE-2026-124452: openemr: OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that…

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...