CRITICAL 9.3 NVD
CVE-2026-124463
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious C
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content through ajax_save.php. Attackers can store a script payload that executes unencoded when the entry is printed via the non-print_html branch of rx_print.php, performing actions and reading data as the victim user.
References
- https://github.com/openemr/openemr/security/advisories/GHSA-rc6m-6pq4-r69x
- https://www.vulncheck.com/advisories/openemr-before-8.3.0-stored-xss-via-camos-rx-print-vi
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-11-08 via NVD.
Risk Timeline
CVE Disclosed2026-11-08 · -1 days ago
Remediation Resources
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.