Openemr CVE-2026-33912

The CVSS 3.1 score of 5.4 reflects a Medium severity rating with specific vector characteristics: Network attack vector (AV:N) means remote exploitation is possible, Low complexity (AC:L) indicates no special conditions needed, Low privilege requirement (PR:L) mandates prior authentication, and Required user interaction (UI:R) necessitates victim action. The vulnerability is not listed in known exploit databases or CISA KEV catalog based on provided data, suggesting no active widespread exploitation at the time of disclosure. However, real-world risk is elevated beyond the numeric score because: (1) healthcare organizations represent high-value targets with sensitive data; (2) authenticated users in medical environments often have elevated privileges; (3) stored XSS is automatically triggered without additional social engineering; (4) patches are available and referenced via GitHub commits, enabling prioritization. The SSVC decision framework would classify this as exploitable (requires authentication but easily automatable), with moderate technical impact (confidentiality and integrity of health records) in a healthcare context. Priority should be moderate-to-high for healthcare deployments, not necessarily proportional to CVSS alone.

A disgruntled healthcare staff member with valid OpenEMR credentials crafts a malicious patient intake form containing JavaScript that steals session tokens and forwards them to an attacker-controlled server. When a physician victim submits or reviews this form, the injected script silently executes in their authenticated browser session, allowing the attacker to assume the physician's identity and access sensitive patient records, modify medical histories, or intercept prescriptions. The attack requires minimal technical sophistication once credentials are obtained and is difficult for users to detect due to the persistent nature of stored XSS.