CVE-2026-103935

HighCVSS 8.1/10Last modified Nov 10, 2026

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
openemr	openemr	< 8.3.0

References

https://github.com/openemr/openemr/commit/d301444f6c4d9c4fa732ce57f3989214081c6108Patch
https://github.com/openemr/openemr/pull/13192Issue Tracking, Patch
https://github.com/openemr/openemr/releases/tag/v8_3_0Product, Release Notes
https://github.com/openemr/openemr/security/advisories/GHSA-pm2v-5p99-37p2Exploit, Vendor Advisory

Timeline

Published: Nov 5, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1039367.5libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener pr CVE-2026-1039378.7Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing CVE-2026-1039387.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/patient_f CVE-2026-1039395.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/c CVE-2026-1039468.3An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.CVE-2026-10395610.0Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain s CVE-2026-1039576.2Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain CVE-2026-1039587.6Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticate CVE-2026-1039626.1The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin f CVE-2026-1039637.5A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session CVE-2026-1039644.3The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via t CVE-2026-1039655.4An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriti