EUVD-2026-13229Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPatient logs into portal
-
DeliverySubmits payment with XSS payload
-
ExploitPayload stored in paylib.php
-
ExecutionStaff reviews payment in portal_payment.php
-
PersistMalicious JavaScript executes in staff browser
-
ImpactSession hijacking or credential theft
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | OpenEMR versions prior to 8.0.0.2. Attacker must be a patient portal user who submits a payment with malicious JavaScript payload via the payment flow in portal/lib/paylib.php. Staff member must review the payment submission in portal/portal_payment.php for XSS execution. |
| Impact | The CVSS 8.7 score reflects high potential impact but requires nuanced interpretation. The attack vector is network-based with low complexity, but crucially requires low privileges (authenticated patient account) and user interaction (staff reviewing payments). The changed scope (S:C) indicates potential to affect resources beyond the vulnerable component. With no KEV listing, no known POCs, and requiring authenticated access plus social engineering, this represents a serious but not critical risk. The exploitation would not be automatable and requires specific targeting of healthcare staff, making mass exploitation unlikely despite the high CVSS score. |
| Exploit ScenarioDerived | An attacker with patient portal credentials submits a payment with embedded JavaScript in payment details or reference fields. When a staff member reviews the payment submission through the administrative interface, the malicious script executes in their browser context, potentially stealing session cookies or performing unauthorized actions. The attack requires minimal technical skill once authenticated but depends on staff interaction with the poisoned payment record. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 19, 2026
A stored cross-site scripting vulnerability in OpenEMR's patient portal payment flow allows authenticated patient users to inject malicious JavaScript that executes when staff members review payment submissions. The vulnerability affects OpenEMR versions prior to 8.0.0.2 and enables attackers to compromise staff accounts, potentially accessing sensitive medical records and administrative functions. No evidence of active exploitation exists, and no KEV listing or public POC has been identified.
RemediationAI
Upgrade OpenEMR to version 8.0.0.2 or later, which includes the security fix documented in commit 6e9e1566d6e271a6d839614674b887e3a73d7da1. Until patching is possible, consider implementing input validation rules at the web application firewall level to filter potentially malicious JavaScript in payment-related fields, and ensure staff are trained to recognize suspicious payment submissions. Full remediation details are available in the GitHub security advisory at https://github.com/openemr/openemr/security/advisories/GHSA-qvf6-6xc6-9qv7.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenEMR is an open-source electronic health records and medical practice management application identified by CPE cpe:2.3:a:openemr:openemr. The vulnerability stems from improper input validation and output encoding (CWE-79) in the PHP-based patient portal payment workflow. Specifically, user-supplied data is stored through portal/lib/paylib.php without proper sanitization and subsequently rendered in portal/portal_payment.php without HTML entity encoding, allowing JavaScript payloads to execute in the context of staff browsers.
Know when Openemr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, a stored cross-site scripting (XSS) vulnerability in the patient portal payment flow allows a patient portal user to persist arbitrary JavaScript that executes in the browser of a staff member who reviews the payment submission. The payload is stored via portal/lib/paylib.php and rendered without escaping in portal/portal_payment.php. Version 8.0.0.2 fixes the issue.
Executive ViewAI
OpenEMR versions prior to 8.0.0.2 contain a stored cross-site scripting vulnerability in the patient portal payment flow that allows authenticated patients to inject malicious code executed in staff browsers, creating a pathway to compromise staff accounts and access protected health information and administrative systems. This risk directly threatens HIPAA compliance and patient data confidentiality across any healthcare organization using affected OpenEMR deployments.
Apply vendor patch to OpenEMR version 8.0.0.2 or later. If immediate patching is not feasible, implement input validation and output encoding on all patient-submitted payment data before staff review; restrict staff payment review access to least-privilege accounts; monitor and log all payment portal submissions for anomalous script patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
Exploit-DB