CVE-2026-126476
MEDIUM
NVD
CVSS Score
6.1
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data.