{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-24T04:49:50.127","vulnerabilities":[{"cve":{"id":"CVE-2026-33303","sourceIdentifier":"security-advisories@github.com","published":"2026-03-19T21:17:11.540","lastModified":"2026-03-20T15:07:01.427","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 are vulnerable to stored cross-site scripting (XSS) via unescaped `portal_login_username` in the portal credential print view. A patient portal user can set their login username to an XSS payload, which then executes in a clinic staff member's browser when they open the \"Create Portal Login\" page for that patient. This crosses from the patient session context into the staff/admin session context. Version 8.0.0.2 fixes the issue."},{"lang":"es","value":"OpenEMR es una aplicación de gestión de registros de salud electrónicos y práctica médica de código abierto y gratuita. Las versiones anteriores a la 8.0.0.2 son vulnerables a cross-site scripting (XSS) almacenado a través de 'portal_login_username' sin escapar en la vista de impresión de credenciales del portal. Un usuario del portal de pacientes puede establecer su nombre de usuario de inicio de sesión a una carga útil de XSS, que luego se ejecuta en el navegador de un miembro del personal de la clínica cuando abren la página 'Crear inicio de sesión del portal' para ese paciente. Esto cruza del contexto de la sesión del paciente al contexto de la sesión del personal/administrador. La versión 8.0.0.2 corrige el problema."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.0.2","matchCriteriaId":"C78F19AD-BD18-4F61-8B1C-DD099DBC6D34"}]}]}],"references":[{"url":"https://github.com/openemr/openemr/commit/c32139b5144b1c704015221520ad2f931e25f10d","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-cp37-pmfx-5mhm","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}}]}