CVE-2026-103935

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0.

• CWE-79

• https://github.com/openemr/openemr/commit/d301444f6c4d9c4fa732ce57f3989214081c6108
• https://github.com/openemr/openemr/pull/13192
• https://github.com/openemr/openemr/releases/tag/v8_3_0
• https://github.com/openemr/openemr/security/advisories/GHSA-pm2v-5p99-37p2

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103922Capacitor is a cross-platform native runtime for web applica…9.3
• CVE-2026-103923KaTeX is a fast, easy-to-use JavaScript library for TeX math…2.1
• CVE-2026-103928Metabase is an open source business intelligence and analyti…9.3
• CVE-2026-103929mise manages dev tools like node, python, cmake, and terrafo…7.8
• CVE-2026-103930cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.…3.7
• CVE-2026-103932ModSecurity is an open source, cross platform web applicatio…5.8
• CVE-2026-103936libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-103937Misskey is an open source, federated social media platform. …8.7
• CVE-2026-103938OpenEMR is a free and open source electronic health records …7.1
• CVE-2026-103939OpenEMR is a free and open source electronic health records …5.4
• CVE-2026-103946An SQL injection vulnerability could allow an authenticated …8.3
• CVE-2026-103956Missing authentication for critical function in the authenti…10