CVE-2026-46518

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a clinician's browser session. Patient demographic fields (name, address) are rendered without output encoding in multiprintcss_header(), and portal patients can write attacker-controlled HTML directly into patient_data by calling the PUT api/patient/:num endpoint, which bypasses the intended audit review workflow. Because the XSS fires in the clinician's authenticated session on the main OpenEMR interface, the attacker can access CSRF tokens, session data, and perform actions as the clinician — crossing the patient-to-clinician trust boundary. This issue has been patched in version 8.0.0.1.

• CWE-79
• CWE-862

• https://github.com/openemr/openemr/security/advisories/GHSA-4gh4-q39r-45wfExploit, Vendor Advisory
• https://github.com/openemr/openemr/security/advisories/GHSA-4gh4-q39r-45wfExploit, Vendor Advisory

Published

Jun 10, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46512Frogman provides headless PBX control through MCP and HTTP A…9.9
• CVE-2026-46513Frogman provides headless PBX control through MCP and HTTP A…7.4
• CVE-2026-46514Frogman provides headless PBX control through MCP and HTTP A…6.5
• CVE-2026-46515Frogman provides headless PBX control through MCP and HTTP A…9.3
• CVE-2026-46516Frogman provides headless FreePBX control. Prior to version …4.8
• CVE-2026-46517LMDeploy is a toolkit for compressing, deploying, and servin…7.8
• CVE-2026-46519mcp-server-kubernetes is a Model Context Protocol server for…8.8
• CVE-2026-4652On a system exposing an NVMe/TCP target, a remote client can…7.5
• CVE-2026-46520ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-46521ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-46522ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-46523ImageMagick is free and open-source software used for editin…6.2