CVE-2026-126476

CVSS 6.1 (medium) · published 2026-11-13

OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data.

Weakness: CWE-79

Source: NVD CVE-2026-126476

References

• https://github.com/openemr/openemr/security/advisories/GHSA-8mwp-vq82-x5mr
• https://www.vulncheck.com/advisories/openemr-before-8.5.0-reflected-xss-via-auto-suggest-searchmode-parameter

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.