CVE-2026-124452
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note that executes when clinicians generate the Eye Exam patient report, exposing session cookies.