CVE-2026-33348

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33348", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-18T22:15:11.814Z", "datePublished": "2026-03-25T22:30:37.489Z", "dateUpdated": "2026-03-26T15:00:29.982Z"}, "containers": {"cna": {"title": "OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h"}, {"name": "https://github.com/openemr/openemr/commit/f488efbe3eb7f17d0f057f960020cb611149f8a2", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/commit/f488efbe3eb7f17d0f057f960020cb611149f8a2"}, {"name": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3"}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"version": "< 8.0.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T22:41:25.855Z"}, "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Users with the\u00a0`Notes - my encounters`\u00a0role can fill\u00a0Eye Exam\u00a0forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with the same role. Versions prior to 8.0.0.3 have a stored cross-site scripting (XSS) vulnerability in the function to display the form answers, allowing any authenticated attacker with the specific role to insert arbitrary JavaScript into the system by entering malicious payloads to the form answers. The JavaScript code is later executed by any user with the form role when viewing the form answers in the patient encounter pages or visit history. Version 8.0.0.3 contains a patch."}], "source": {"advisory": "GHSA-6ch2-p26g-x33h", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T15:00:17.198465Z", "id": "CVE-2026-33348", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T15:00:29.982Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33348", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-26T15:00:17.198465Z"}}}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T15:00:26.387Z"}}], "cna": {"title": "OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3", "source": {"advisory": "GHSA-6ch2-p26g-x33h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0.3"}]}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h", "name": "https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openemr/openemr/commit/f488efbe3eb7f17d0f057f960020cb611149f8a2", "name": "https://github.com/openemr/openemr/commit/f488efbe3eb7f17d0f057f960020cb611149f8a2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "name": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Users with the\u00a0`Notes - my encounters`\u00a0role can fill\u00a0Eye Exam\u00a0forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with the same role. Versions prior to 8.0.0.3 have a stored cross-site scripting (XSS) vulnerability in the function to display the form answers, allowing any authenticated attacker with the specific role to insert arbitrary JavaScript into the system by entering malicious payloads to the form answers. The JavaScript code is later executed by any user with the form role when viewing the form answers in the patient encounter pages or visit history. Version 8.0.0.3 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T22:41:25.855Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33348", "state": "PUBLISHED", "dateUpdated": "2026-03-26T15:00:29.982Z", "dateReserved": "2026-03-18T22:15:11.814Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-25T22:30:37.489Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openemr", "vendor": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "matchCriteriaId": "E3E098AF-42A1-4798-85A7-80052F19F809", "versionEndExcluding": "8.0.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Users with the\u00a0`Notes - my encounters`\u00a0role can fill\u00a0Eye Exam\u00a0forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with the same role. Versions prior to 8.0.0.3 have a stored cross-site scripting (XSS) vulnerability in the function to display the form answers, allowing any authenticated attacker with the specific role to insert arbitrary JavaScript into the system by entering malicious payloads to the form answers. The JavaScript code is later executed by any user with the form role when viewing the form answers in the patient encounter pages or visit history. Version 8.0.0.3 contains a patch."}, {"lang": "es", "value": "OpenEMR es una aplicaci\u00f3n de gesti\u00f3n de pr\u00e1ctica m\u00e9dica y registros de salud electr\u00f3nicos de c\u00f3digo abierto y gratuita. Los usuarios con el rol 'Notes - my encounters' pueden completar formularios de Examen Ocular en los encuentros con pacientes. Las respuestas del formulario se muestran en la p\u00e1gina del encuentro y en el historial de visitas para los usuarios con el mismo rol. Las versiones anteriores a la 8.0.0.3 tienen una vulnerabilidad de cross-site scripting (XSS) almacenado en la funci\u00f3n para mostrar las respuestas del formulario, permitiendo a cualquier atacante autenticado con el rol espec\u00edfico insertar JavaScript arbitrario en el sistema introduciendo cargas \u00fatiles maliciosas en las respuestas del formulario. El c\u00f3digo JavaScript es ejecutado posteriormente por cualquier usuario con el rol del formulario al ver las respuestas del formulario en las p\u00e1ginas de encuentro con el paciente o en el historial de visitas. La versi\u00f3n 8.0.0.3 contiene un parche."}], "id": "CVE-2026-33348", "lastModified": "2026-06-17T10:37:21.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33348", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T15:00:17.198465Z", "version": "2.0.3"}}]}, "published": "2026-03-25T23:17:09.840", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openemr/openemr/commit/f488efbe3eb7f17d0f057f960020cb611149f8a2"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.0.0.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openemr", "source": "cna", "vendor": "openemr"}, "product": "openemr", "vendor": "openemr"}], "analysis": {"en": {"generated_at": "2026-03-26T19:36:01.463031+00:00", "value": {"mitigation_remediation": ["Upgrade OpenEMR to version\u00a08.0.0.3\u00a0or later which contains the patch", "Verify the upgrade and restart the application", "Limit the Notes\u2011my\u2011encounters role to trusted users if an immediate upgrade is not feasible"], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the OpenEMR electronic health records application. All installations running a version prior to 8.0.0.3 are vulnerable. In particular, the store function for the Eye Exam form ($CHRONIC2 and $CHRONIC3) lacks output escaping.", "description_and_impact": "OpenEMR stores user\u2011supplied input from Eye Exam forms in patient encounter records. The input is rendered without proper sanitization, allowing an attacker with the Notes\u2011my\u2011encounters role to inject arbitrary JavaScript. When other users with the same role view the encounter pages or visit history, the malicious script runs in their browser, potentially hijacking sessions, modifying displayed data, or retrieving sensitive information. This stored XSS flaw is a classic cross\u2011site scripting weakness that grants the attacker the same privileges as any user of the affected role.", "risk_and_exploitability": "The CVSS base score is 8.7, reflecting a high\u2011impact flaw that is exploitable by an authenticated user. EPSS is under 1\u202f%, indicating that current exploit prevalence is low, and the flaw is not listed in the CISA KEV catalog. Nevertheless, the attack requires only a valid OpenEMR account with the specific form role, meaning that any compromised or legitimate account could be abused. Because the erroneous browser code runs in the victim's context, the attack can be performed silently and widely, so administrators should treat it as a serious risk."}}}}, "created": "2026-03-26T11:31:20.652778+00:00", "updated": "2026-03-27T09:29:29.933108+00:00", "vendors": ["openemr", "openemr$PRODUCT$openemr"]}