CVE-2026-33348

OpenEMR is a free and open source electronic health records and medical practice management application. Users with the `Notes - my encounters` role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with the same role. Versions prior to 8.0.0.3 have a stored cross-site scripting (XSS) vulnerability in the function to display the form answers, allowing any authenticated attacker with the specific role to insert arbitrary JavaScript into the system by entering malicious payloads to the form answers. The JavaScript code is later executed by any user with the form role when viewing the form answers in the patient encounter pages or visit history. Version 8.0.0.3 contains a patch.

• CWE-79

• https://github.com/openemr/openemr/commit/f488efbe3eb7f17d0f057f960020cb611149f8a2Patch
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3Product
• https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33hExploit, Vendor Advisory
• https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33hExploit, Vendor Advisory

Published

Mar 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33340LoLLMs WEBUI provides the Web user interface for Lord of Lar…9.1
• CVE-2026-33343etcd is a distributed key-value store for the data of a dist…6.5
• CVE-2026-33344Dagu is a workflow engine with a built-in Web user interface…8.1
• CVE-2026-33345solidtime is an open-source time-tracking app. Prior to vers…6.5
• CVE-2026-33346OpenEMR is a free and open source electronic health records …8.7
• CVE-2026-33347league/commonmark is a PHP Markdown parser. From version 2.3…6.1
• CVE-2026-33349fast-xml-parser allows users to process XML from JS object w…5.9
• CVE-2026-3335The Canto plugin for WordPress is vulnerable to Missing Auth…5.3
• CVE-2026-33350LORIS (Longitudinal Online Research and Imaging System) is a…7.5
• CVE-2026-33351WWBN AVideo is an open source video platform. Prior to versi…9.1
• CVE-2026-33352WWBN AVideo is an open source video platform. Prior to versi…9.8
• CVE-2026-33353Soft Serve is a self-hostable Git server for the command lin…6.5