6.1
CVE-2026-40507
- EPSS 0.24%
- Veröffentlicht 19.08.2026 14:48:49
- Zuletzt bearbeitet 25.08.2026 03:16:54
- CVE-Watchlists
- Unerledigt
OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal
OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any authenticated user with Forms Administration permissions who visits the link, enabling session hijacking.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstelleropenemr
≫
Produkt
openemr
Default Statusaffected
Version
0
Version <
8.3.0
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.24% | 0.158 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| disclosure@vulncheck.com | 5.1 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| disclosure@vulncheck.com | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://github.com/openemr/openemr/security/advisories/GHSA-rmmr-8498-463g
https://github.com/openemr/openemr/releases/tag/v8_3_0
https://github.com/openemr/openemr/commit/ba316dd1d8de1291102da3f20f64240729ff899e
https://www.vulncheck.com/advisories/openemr-reflected-xss-via-templatehtml-parameter-in-patient-portal