CVE-2026-33346

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, a stored cross-site scripting (XSS) vulnerability in the patient portal payment flow allows a patient portal user to persist arbitrary JavaScript that executes in the browser of a staff member who reviews the payment submission. The payload is stored via `portal/lib/paylib.php` and rendered without escaping in `portal/portal_payment.php`. Version 8.0.0.2 fixes the issue.

• CWE-79

• https://github.com/openemr/openemr/commit/6e9e1566d6e271a6d839614674b887e3a73d7da1Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-qvf6-6xc6-9qv7Exploit, Vendor Advisory
• https://github.com/openemr/openemr/security/advisories/GHSA-qvf6-6xc6-9qv7Exploit, Vendor Advisory

Published

Mar 19, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33337Firebird is an open-source relational database management sy…7.5
• CVE-2026-3334The CMS Commander plugin for WordPress is vulnerable to SQL …8.8
• CVE-2026-33340LoLLMs WEBUI provides the Web user interface for Lord of Lar…9.1
• CVE-2026-33343etcd is a distributed key-value store for the data of a dist…6.5
• CVE-2026-33344Dagu is a workflow engine with a built-in Web user interface…8.1
• CVE-2026-33345solidtime is an open-source time-tracking app. Prior to vers…6.5
• CVE-2026-33347league/commonmark is a PHP Markdown parser. From version 2.3…6.1
• CVE-2026-33348OpenEMR is a free and open source electronic health records …5.4
• CVE-2026-33349fast-xml-parser allows users to process XML from JS object w…5.9
• CVE-2026-3335The Canto plugin for WordPress is vulnerable to Missing Auth…5.3
• CVE-2026-33350LORIS (Longitudinal Online Research and Imaging System) is a…7.5
• CVE-2026-33351WWBN AVideo is an open source video platform. Prior to versi…9.1