CVE-2026-103935High· 8.1▾ TwilightOpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored trans…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0.
openemr < 8.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-40507Medium· 6.1OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler
CVE-2026-40508Medium· 5.4OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitra…
CVE-2026-104135Medium· 6.5OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth
CVE-2026-103939Medium· 5.4OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory
CVE-2026-115573High· 8.1OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration
CVE-2026-102940Critical· 9.6OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment