CVE-2026-126462

OpenEMR versions before 8.5.0 are vulnerable to a stored cross-site scripting (XSS) flaw. Authenticated users with Eye Exam edit permissions can inject malicious scripts via the Next Visit Orders PLAN[] field. By storing a payload that closes the textarea in view.php , an attacker can execute Jav...