Openemr CVE-2026-33348

OpenEMR versions prior to 8.0.0.3. Attacker requires authenticated user account with 'Notes - my encounters' role. Attacker must fill Eye Exam form with malicious JavaScript payloads. Victim with same role must view the encounter page or visit history to execute stored XSS.

The CVSS score of 8.7 (High severity) reflects a network-accessible vulnerability with low attack complexity, requiring low privileges and user interaction, with changed scope enabling high confidentiality and integrity impact. The attack vector (AV:N) indicates remote exploitability, while the changed scope (S:C) means the vulnerability can affect resources beyond the vulnerable component's security scope. The requirement for authenticated access with a specific role (PR:L) and user interaction (UI:R) somewhat limits exploitation, but in a healthcare environment where multiple staff members routinely access patient records, the user interaction barrier is easily overcome through normal workflows. Without EPSS or KEV data indicating active exploitation, and given the role-based access requirement, this represents a genuine risk that requires prioritization but is not yet demonstrating widespread exploitation. The healthcare context elevates the real-world severity due to the sensitivity of protected health information (PHI) and regulatory compliance requirements under HIPAA and similar frameworks.

An authenticated attacker with the 'Notes - my encounters' role accesses a patient's encounter and fills out an Eye Exam form, inserting malicious JavaScript payloads into form answer fields such as visual acuity measurements or examination notes. When other healthcare providers or administrative staff with the same role view the patient's encounter page or visit history to review the examination results, the stored JavaScript executes in their browsers, potentially stealing session cookies, capturing keystrokes containing credentials, or performing unauthorized actions like modifying patient records under the victim's authenticated session. The low attack complexity and network accessibility make this readily exploitable by malicious insiders or compromised accounts.