EUVD-2026-52349
GHSA-rv29-9mq6-7j5q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H for required admin credentials; S:C because stored XSS impacts users beyond the injecting admin's own session; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Attackers can exploit the lack of output encoding at the template retrieval endpoint combined with missing HttpOnly cookie attributes to exfiltrate session tokens via document.cookie access, enabling full session hijacking of any admin, clinician, or portal patient who views a poisoned template.
AnalysisAI
Stored cross-site scripting in OpenEMR's patient portal template system (through version 8.2.0) allows authenticated administrators to inject persistent JavaScript payloads that execute in the browsers of any admin, clinician, or portal patient who views a poisoned template. The combination of absent output encoding at the template retrieval endpoint and missing HttpOnly attributes on session cookies enables direct document.cookie exfiltration, resulting in full session hijacking of privileged healthcare accounts. No public exploit identified in CISA KEV, but a publicly available proof-of-concept and detailed researcher writeup (VulnCheck / jivasecurity.com) significantly lower the bar for exploitation in targeted scenarios.
Technical ContextAI
OpenEMR is a widely used open-source electronic health records (EHR) and practice management application built on PHP, covering the full CPE range cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:* through version 8.2.0. The vulnerable component is the patient portal template management system - the template save endpoint applies only a blocklist filter for literal PHP open tags (<?php), leaving HTML event handlers, <script> blocks, javascript: URI schemes, and similar injection vectors fully unblocked. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: attacker-controlled template content is stored to the database and later rendered to victim browsers without output encoding or contextual escaping. The compounding weakness is the absence of the HttpOnly attribute on OpenEMR session cookies, which allows JavaScript executing in the page context to read document.cookie directly, converting a stored XSS into a reliable session-hijacking primitive against high-value healthcare accounts.
RemediationAI
No vendor-released patch version has been confirmed in the available data - organizations should monitor the official OpenEMR release channel and GitHub repository for a fix and apply it immediately upon release. As compensating controls pending a patch: enforce HttpOnly and Secure flags on session cookies by setting session.cookie_httponly = 1 and session.cookie_secure = 1 in php.ini or OpenEMR's session configuration - this severs the cookie-exfiltration chain even if XSS payloads execute, though it does not eliminate the underlying injection. Deploy a Content Security Policy (CSP) response header that disallows inline script execution (script-src 'self') to further limit XSS impact, noting this may break legitimate OpenEMR UI functionality and requires testing. Restrict access to the template management endpoint to the smallest feasible set of trusted administrator accounts and review audit logs for unauthorized template modifications. Advisory references: https://www.vulncheck.com/advisories/openemr-stored-xss-via-import-template-php-template-management and https://jivasecurity.com/writeups/openemr-portal-template-stored-xss.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today