CVE-2026-126475

OpenEMR versions prior to 8.5.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the application/index/search endpoint. The root cause is the lack of proper encoding for the searchEleNo POST parameter, allowing authenticated attackers to break out of unencoded HTML at...