CVE-2026-33348

// PoC for CVE-2026-33348 Stored XSS in OpenEMR // 1. Login as a user with the 'Notes - my encounters' role. // 2. Navigate to a patient encounter and open the 'Eye Exam' form. // 3. Inject the following payload into a vulnerable input field (e.g., exam notes). var payload = "<script>alert('CVE-2026-33348 XSS');</script>"; // 4. Save the form. // 5. Wait for an administrator or another user with the same role to view the encounter. // 6. The JavaScript will execute in the victim's browser context.

{"cve": {"id": "CVE-2026-33348", "sourceIdentifier": "[email protected]", "published": "2026-03-25T23:17:09.840", "lastModified": "2026-03-26T18:02:20.603", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Users with the `Notes - my encounters` role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with the same role. Versions prior to 8.0.0.3 have a stored cross-site scripting (XSS) vulnerability in the function to display the form answers, allowing any authenticated attacker with the specific role to insert arbitrary JavaScript into the system by entering malicious payloads to the form answers. The JavaScript code is later executed by any user with the form role when viewing the form answers in the patient encounter pages or visit history. Version 8.0.0.3 contains a patch."}, {"lang": "es", "value": "OpenEMR es una aplicación de gestión de práctica médica y registros de salud electrónicos de código abierto y gratuita. Los usuarios con el rol 'Notes - my encounters' pueden completar formularios de Examen Ocular en los encuentros con pacientes. Las respuestas del formulario se muestran en la página del encuentro y en el historial de visitas para los usuarios con el mismo rol. Las versiones anteriores a la 8.0.0.3 tienen una vulnerabilidad de cross-site scripting (XSS) almacenado en la función para mostrar las respuestas del formulario, permitiendo a cualquier atacante autenticado con el rol específico insertar JavaScript arbitrario en el sistema introduciendo cargas útiles maliciosas en las respuestas del formulario. El código JavaScript es ejecutado posteriormente por cualquier usuario con el rol del formulario al ver las respuestas del formulario en las páginas de encuentro con el paciente o en el historial de visitas. La versión 8.0.0.3 contiene un parche."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 5.8}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "versionEndExcluding": "8.0.0.3", "matchCriteriaId": "E3E098AF-42A1-4798-85A7-80052F19F809"}]}]}], "references": [{"url": "https://github.com/openemr/openemr/commit/f488efbe3eb7f17d0f057f960020cb611149f8a2", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}