CVE-2026-33912 MEDIUM

CVE-2026-33912: OpenEMR has reflected XSS in ajax_download.php via reportID parameter

Vendor Openemr
Product openemr
Weakness CWE-79 · XSS
Published March 25, 2026
Last update March 26, 2026

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated attacker could craft a malicious form that, when submitted by a victim, executes arbitrary JavaScript in the victim's browser session. Version 8.0.0.3 patches the issue.

Key dates

02Disclosure timeline

March 25, 2026 CVE published
March 26, 2026 Record updated

Related vulnerabilities

04Related CVE