{"id":"CVE-2026-124463","published":"2026-11-08T14:18:14.167","lastModified":"2026-11-10T21:46:35.517","description":"OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content through ajax_save.php. Attackers can store a script payload that executes unencoded when the entry is printed via the non-print_html branch of rx_print.php, performing actions and reading data as the victim user.","cvssScore":8.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-rc6m-6pq4-r69x","tags":[]},{"url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-stored-xss-via-camos-rx-print-view","tags":[]}],"exploitRefs":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-rc6m-6pq4-r69x","tags":[]}],"hasPoc":true,"ai":{"summary":"OpenEMR before 8.3.0 has a stored XSS flaw where authenticated users with CAMOS access can inject malicious HTML via ajax_save.php, which later executes unencoded when printed through rx_print.php's non-print_html branch. This allows attackers to hijack victim sessions and perform unauthorized actions within the application.","exploitability":"Exploitation requires valid low-privileged credentials and user interaction (e.g., a victim viewing or printing the malicious CAMOS entry), making it moderately difficult but feasible for insider threats or compromised accounts.","blast_radius":"Successful exploitation could lead to full session hijacking, unauthorized data access, or privilege escalation within the OpenEMR environment, potentially affecting all users who view the compromised entry.","remediation":"Upgrade to OpenEMR version 8.3.0 or later, which patches the stored XSS vulnerability in CAMOS content handling.","detection":"Defenders should monitor for anomalous HTML/JavaScript sequences in CAMOS-related database entries or logs of ajax_save.php requests followed by unusual patterns in rx_print.php access (e.g., non-print_html branch usage with encoded script payloads). No reliable host or network indicator is derivable from the published description.","tags":["stored-xss","web-app","auth-bypass","session-hijack","healthcare"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:47:44.877Z"}}