VULNERABILITY INTELLIGENCE
CVE-2026-40508
CVSS score5.4 MEDIUM
EPSS probability0.30%
CISA KEVNot currently listed
Published2026-08-19
Last modified2026-10-27
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Description
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious scripts through the template upload functionality, which are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor.
Weakness classification
- disclosure@vulncheck.com: CWE-79