CVE-2026-126477
Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in OpenEMR Eye Exam Module

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eye_mag) module that allows administrators to inject JavaScript through unencoded Eye_defaults list option titles. Attackers can store a crafted title via edit_list.php that breaks out of a jQuery string in eye_base.php, executing script in any authenticated user's session when they click Defaults.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126477
EUVD
EUVD-2026-124947

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openemr openemr to 8.5.0 (exc)
openemr openemr 8.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR before version 8.5.0 has a stored cross-site scripting (XSS) vulnerability in the Eye Exam module. Administrators can inject JavaScript by entering unencoded titles in the Eye_defaults list options. This allows attackers to store malicious titles via edit_list.php, which bypasses jQuery string handling in eye_base.php and executes scripts in authenticated users' sessions when they access Defaults.

Detection Guidance

Check OpenEMR version for versions before 8.5.0. Inspect eye_mag module files like edit_list.php and eye_base.php for unencoded Eye_defaults list option titles. Look for JavaScript injection patterns in stored titles.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the browsers of authenticated users. This could lead to session hijacking, unauthorized data access, or defacement of the OpenEMR interface. Users with administrative privileges are at higher risk as they can inject the payload.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to sensitive patient data, violating HIPAA's security requirements for protecting health information. It may also compromise data integrity and confidentiality, posing risks under GDPR for unauthorized data processing and breaches of personal data.

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Review and sanitize all Eye_defaults list option titles in the eye_mag module. Remove any suspicious JavaScript payloads from stored titles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126477. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...