CVE-2026-33303

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33303", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-18T18:55:47.428Z", "datePublished": "2026-03-19T20:25:05.823Z", "dateUpdated": "2026-03-24T19:46:49.755Z"}, "containers": {"cna": {"title": "OpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print View", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openemr/openemr/security/advisories/GHSA-cp37-pmfx-5mhm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-cp37-pmfx-5mhm"}, {"name": "https://github.com/openemr/openemr/commit/c32139b5144b1c704015221520ad2f931e25f10d", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/commit/c32139b5144b1c704015221520ad2f931e25f10d"}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"version": "< 8.0.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-19T20:25:05.823Z"}, "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 are vulnerable to stored cross-site scripting (XSS) via unescaped `portal_login_username` in the portal credential print view. A patient portal user can set their login username to an XSS payload, which then executes in a clinic staff member's browser when they open the \"Create Portal Login\" page for that patient. This crosses from the patient session context into the staff/admin session context. Version 8.0.0.2 fixes the issue."}], "source": {"advisory": "GHSA-cp37-pmfx-5mhm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T19:46:26.187455Z", "id": "CVE-2026-33303", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T19:46:49.755Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33303", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T19:46:26.187455Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T19:46:42.553Z"}}], "cna": {"title": "OpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print View", "source": {"advisory": "GHSA-cp37-pmfx-5mhm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0.2"}]}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-cp37-pmfx-5mhm", "name": "https://github.com/openemr/openemr/security/advisories/GHSA-cp37-pmfx-5mhm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openemr/openemr/commit/c32139b5144b1c704015221520ad2f931e25f10d", "name": "https://github.com/openemr/openemr/commit/c32139b5144b1c704015221520ad2f931e25f10d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 are vulnerable to stored cross-site scripting (XSS) via unescaped `portal_login_username` in the portal credential print view. A patient portal user can set their login username to an XSS payload, which then executes in a clinic staff member's browser when they open the \"Create Portal Login\" page for that patient. This crosses from the patient session context into the staff/admin session context. Version 8.0.0.2 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-19T20:25:05.823Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33303", "state": "PUBLISHED", "dateUpdated": "2026-03-24T19:46:49.755Z", "dateReserved": "2026-03-18T18:55:47.428Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-19T20:25:05.823Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openemr", "vendor": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "matchCriteriaId": "C78F19AD-BD18-4F61-8B1C-DD099DBC6D34", "versionEndExcluding": "8.0.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 are vulnerable to stored cross-site scripting (XSS) via unescaped `portal_login_username` in the portal credential print view. A patient portal user can set their login username to an XSS payload, which then executes in a clinic staff member's browser when they open the \"Create Portal Login\" page for that patient. This crosses from the patient session context into the staff/admin session context. Version 8.0.0.2 fixes the issue."}, {"lang": "es", "value": "OpenEMR es una aplicaci\u00f3n de gesti\u00f3n de registros de salud electr\u00f3nicos y pr\u00e1ctica m\u00e9dica de c\u00f3digo abierto y gratuita. Las versiones anteriores a la 8.0.0.2 son vulnerables a cross-site scripting (XSS) almacenado a trav\u00e9s de 'portal_login_username' sin escapar en la vista de impresi\u00f3n de credenciales del portal. Un usuario del portal de pacientes puede establecer su nombre de usuario de inicio de sesi\u00f3n a una carga \u00fatil de XSS, que luego se ejecuta en el navegador de un miembro del personal de la cl\u00ednica cuando abren la p\u00e1gina 'Crear inicio de sesi\u00f3n del portal' para ese paciente. Esto cruza del contexto de la sesi\u00f3n del paciente al contexto de la sesi\u00f3n del personal/administrador. La versi\u00f3n 8.0.0.2 corrige el problema."}], "id": "CVE-2026-33303", "lastModified": "2026-06-17T10:37:17.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33303", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T19:46:26.187455Z", "version": "2.0.3"}}]}, "published": "2026-03-19T21:17:11.540", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openemr/openemr/commit/c32139b5144b1c704015221520ad2f931e25f10d"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-cp37-pmfx-5mhm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.0.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openemr", "source": "cna", "vendor": "openemr"}, "product": "openemr", "vendor": "openemr"}], "analysis": {"en": {"generated_at": "2026-03-20T16:29:38.762201+00:00", "value": {"mitigation_remediation": ["Upgrade OpenEMR to version 8.0.0.2 or later", "Verify that the new release is deployed on all systems running OpenEMR", "Confirm that no legacy code remains that could re\u2011introduce the XSS issue"], "summary": {"action": "Immediate Patch", "impact": "Stored XSS that can execute script in clinic staff or admin browsers"}, "threat_synthesis": {"affected_systems": "The vulnerability affects OpenEMR installations before version 8.0.0.2. All users running those earlier releases are at risk, while version 8.0.0.2 and later contain the fix.", "description_and_impact": "A stored cross\u2011site scripting vulnerability in OpenEMR allows a patient portal user to set a login username containing an XSS payload. When a clinic staff member opens the Create Portal Login page for that patient, the injected script runs in the staff member's browser, allowing an attacker to execute arbitrary client\u2011side code with the staff session context.", "risk_and_exploitability": "The CVSS score is 5.4, reflecting a moderate severity. The EPSS score is below 1%, indicating a low likelihood of observed exploits, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a legitimate patient portal account that can set a username; the attack then requires a staff member to view the credential print page, which is typically a routine administrative action. Given these constraints the overall risk remains moderate, but the impact of execution in an administrative session is significant."}}}}, "created": "2026-03-20T08:56:18.066462+00:00", "updated": "2026-03-25T11:55:04.914388+00:00", "vendors": ["openemr", "openemr$PRODUCT$openemr"]}