High
9.3
OpenEMR before 8.3.0 Stored XSS via CAMOS Rx Print View
CVE-2026-124463
First seen on SecPulse
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| openemropenemr |
< 8.3.0→ 8.3.0 |
8.3.0 |
Original description The description as published by the source.
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content through ajax_save.php. Attackers can store a script payload that executes unencoded when the entry is printed via the non-print_html branch of rx_print.php, performing actions and reading data as the victim user.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory nvd.nist.gov
- advisory github.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web github.com