MEDIUMCVSS 5.40% EPSS
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal users to inject JavaScript via the tableArgs field of the onsiteportalactivity API. Attackers can store a payload with spaces that breaks out of an unquoted data-delete-id attribute, executing script when providers click the delete button on the audit review page.
Published 2026-11-13 · last modified 2026-11-13
| Vendor | Product |
|---|---|
| open-emr | openemr |
Ncerio by BeyondNets · data from NVD, CISA KEV, EPSS.