CVE-2026-126451

OpenEMR versions prior to 8.5.0 are vulnerable to a stored cross-site scripting (XSS) flaw during Document Template Rendering . The root cause is the DocumentTemplateRender function, which fails to sanitize an encounterForm value rendered into an iframe src. This allows portal patients to inject ...