CVE-2026-33348

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-33348

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33348.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-33348

Aliases

GHSA-6ch2-p26g-x33h

Published

2026-03-25T22:30:37.489Z

Modified

2026-04-10T05:42:44.361797Z

Severity

8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator

Summary

OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3

Details

OpenEMR is a free and open source electronic health records and medical practice management application. Users with the Notes - my encounters role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with the same role. Versions prior to 8.0.0.3 have a stored cross-site scripting (XSS) vulnerability in the function to display the form answers, allowing any authenticated attacker with the specific role to insert arbitrary JavaScript into the system by entering malicious payloads to the form answers. The JavaScript code is later executed by any user with the form role when viewing the form answers in the patient encounter pages or visit history. Version 8.0.0.3 contains a patch.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33348.json"
}

References

Affected packages

Git / github.com/openemr/openemr

Affected ranges

Type

GIT

Repo

https://github.com/openemr/openemr

Events

Introduced

Fixed

7c96c8eefe460d6fadbccbe93d0fa6bf819acd69

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.0.0.3"
        }
    ]
}

Affected versions

Other

v2_7_2

v2_7_2-rc1

v2_7_2-rc2

v2_7_3-rc1

v2_8_0

v2_8_1

v2_8_2

v2_8_3

v2_9_0

v3_0_0

v3_0_1

v8_0_0

v8_0_0_1

v8_0_0_2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33348.json"