CVE-2026-33348 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0.3 contains a stored cross-site scripting vulnerability caused by improper sanitization of Eye Exam form answers, letting authenticated users with 'Notes - my encounters' role execute arbitrary JavaScript, exploit requires specific role.

Severity & Score

Impact

Authenticated users with the role can execute arbitrary JavaScript, potentially leading to session hijacking or unauthorized actions.

Mitigation

Update to version 8.0.0.3 or later.

References

• https://github.com/openemr/openemr/security/advisories/GHSA-6ch2-p26g-x33h
• https://github.com/openemr/openemr/commit/f488efbe3eb7f17d0f057f960020cb611149f8a2
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 25, 2026

🟠 CVE-2026-33348 - High (8.7) OpenEMR is a free and open source electronic health records and medical practice management application. Users with the `Notes - my encounters` role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the en... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33348/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner