What is the CVSS score of CVE-2026-33346?

CVE-2026-33346 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33346?

OpenEMR versions prior to 8.0.0.2 contain a stored cross-site scripting vulnerability in the patient portal payment flow that allows authenticated patients to inject malicious code executed in staff…. A patch is available.

How to fix or mitigate CVE-2026-33346?

Within 24 hours: inventory all OpenEMR instances and identify those running versions prior to 8.0.0.2; notify security and clinical operations teams of the risk scope. Within 7 days: upgrade all affected OpenEMR installations to version 8.0.0.2 or later per vendor guidance; conduct post-upgrade validation of payment portal functionality. Within 30 days: perform access log review for the 90-day period prior to patching to identify any suspicious payment submission activity; audit staff account activities for unauthorized access.

PHP CVE-2026-33346

EUVD-2026-13229 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-19 GitHub_M

PHP XSS

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:20 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

8.0.0.2

EUVD ID Assigned

Mar 19, 2026 - 21:00 euvd

EUVD-2026-13229

Analysis Generated

Mar 19, 2026 - 21:00 vuln.today

CVE Published

Mar 19, 2026 - 20:33 nvd

HIGH 8.7

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, a stored cross-site scripting (XSS) vulnerability in the patient portal payment flow allows a patient portal user to persist arbitrary JavaScript that executes in the browser of a staff member who reviews the payment submission. The payload is stored via portal/lib/paylib.php and rendered without escaping in portal/portal_payment.php. Version 8.0.0.2 fixes the issue.

AnalysisAI

A stored cross-site scripting vulnerability in OpenEMR's patient portal payment flow allows authenticated patient users to inject malicious JavaScript that executes when staff members review payment submissions. The vulnerability affects OpenEMR versions prior to 8.0.0.2 and enables attackers to compromise staff accounts, potentially accessing sensitive medical records and administrative functions. No evidence of active exploitation exists, and no KEV listing or public POC has been identified.

Technical ContextAI

OpenEMR is an open-source electronic health records and medical practice management application identified by CPE cpe:2.3:a:openemr:openemr. The vulnerability stems from improper input validation and output encoding (CWE-79) in the PHP-based patient portal payment workflow. Specifically, user-supplied data is stored through portal/lib/paylib.php without proper sanitization and subsequently rendered in portal/portal_payment.php without HTML entity encoding, allowing JavaScript payloads to execute in the context of staff browsers.

RemediationAI

Upgrade OpenEMR to version 8.0.0.2 or later, which includes the security fix documented in commit 6e9e1566d6e271a6d839614674b887e3a73d7da1. Until patching is possible, consider implementing input validation rules at the web application firewall level to filter potentially malicious JavaScript in payment-related fields, and ensure staff are trained to recognize suspicious payment submissions. Full remediation details are available in the GitHub security advisory at https://github.com/openemr/openemr/security/advisories/GHSA-qvf6-6xc6-9qv7.