CVE-2026-126424: OpenEMR before 8.5.0 Stored XSS via Billing Code Descriptions
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write permission to inject HTML into SNOMED code descriptions via superbillcustomfull.php. When a clinician selects the malicious code, the Functional and Cognitive Status form or fee-sheet forms assign it to innerHTML, executing JavaScript in the clinician's session to read patient data and perform actions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an account with admin or superbill write permission to place malicious HTML in a SNOMED code description. The payload executes when a clinician selects the affected code in the Functional and Cognitive Status form or fee-sheet forms.
What can a successful attack do?
JavaScript executes in the clinician's authenticated session. This can allow the attacker to read patient data and perform actions available to that clinician.
Which deployments are affected?
OpenEMR versions before 8.5.0 are affected when users can write superbill data and clinicians use the affected forms to select the malicious code.