{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-24T11:25:37.544","vulnerabilities":[{"cve":{"id":"CVE-2026-33348","sourceIdentifier":"security-advisories@github.com","published":"2026-03-25T23:17:09.840","lastModified":"2026-03-26T18:02:20.603","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR is a free and open source electronic health records and medical practice management application. Users with the `Notes - my encounters` role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with the same role. Versions prior to 8.0.0.3 have a stored cross-site scripting (XSS) vulnerability in the function to display the form answers, allowing any authenticated attacker with the specific role to insert arbitrary JavaScript into the system by entering malicious payloads to the form answers. The JavaScript code is later executed by any user with the form role when viewing the form answers in the patient encounter pages or visit history. Version 8.0.0.3 contains a patch."},{"lang":"es","value":"OpenEMR es una aplicación de gestión de práctica médica y registros de salud electrónicos de código abierto y gratuita. Los usuarios con el rol 'Notes - my encounters' pueden completar formularios de Examen Ocular en los encuentros con pacientes. Las respuestas del formulario se muestran en la página del encuentro y en el historial de visitas para los usuarios con el mismo rol. Las versiones anteriores a la 8.0.0.3 tienen una vulnerabilidad de cross-site scripting (XSS) almacenado en la función para mostrar las respuestas del formulario, permitiendo a cualquier atacante autenticado con el rol específico insertar JavaScript arbitrario en el sistema introduciendo cargas útiles maliciosas en las respuestas del formulario. El código JavaScript es ejecutado posteriormente por cualquier usuario con el rol del formulario al ver las respuestas del formulario en las páginas de encuentro con el paciente o en el historial de visitas. La versión 8.0.0.3 contiene un parche."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.0.3","matchCriteriaId":"E3E098AF-42A1-4798-85A7-80052F19F809"}]}]}],"references":[{"url":"https://github.com/openemr/openemr/commit/f488efbe3eb7f17d0f057f960020cb611149f8a2","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/openemr/openemr/releases/tag/v8_0_0_3","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}}]}