CVE-2026-126477: OpenEMR before 8.5.0 Stored XSS via Eye Exam Defaults in eye_base.php
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eyemag) module that allows administrators to inject JavaScript through unencoded Eyedefaults list option titles. Attackers can store a crafted title via editlist.php that breaks out of a jQuery string in eyebase.php, executing script in any authenticated user's session when they click Defaults.
Affected Software
Event History
Frequently Asked Questions
Who can introduce the malicious content, and who can be affected by it?
An administrator can store a crafted Eye_defaults list option title through edit_list.php. Any authenticated user who later clicks Defaults in the Eye Exam (eye_mag) module can have JavaScript execute in their session.
What user interaction is required for exploitation?
The attacker must first store the crafted title, and a target authenticated user must click Defaults. The vulnerability is triggered when the stored title breaks out of a jQuery string in eye_base.php.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected. The provided data does not identify affected configuration conditions beyond use of the Eye Exam module and its Eye_defaults list option titles.