Log in Start free

Vulnerability · Published Mar 19, 2026 · Assigned by GitHub_M

CVE-2026-33346OpenEMR has stored XSS in portal_payment.php via Unescaped table_args

High 8.7

In plain English

A high-severity cross-site scripting in openemr from openemr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High
Exploit odds (30 days)0.3%top 72.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, a stored cross-site scripting (XSS) vulnerability in the patient portal payment flow allows a patient portal user to persist arbitrary JavaScript that executes in the browser of a staff member who reviews the payment submission. The payload is stored via `portal/lib/paylib.php` and rendered without escaping in `portal/portal_payment.php`. Version 8.0.0.2 fixes the issue.

Affected products (as reported)

VendorProductVersions
openemr openemr < 8.0.0.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References