CVE-2026-33911: Open-EMR Openemr

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the POST parameter `title` is reflected back in a JSON response built with `json_encode()`. Because the response is served with a `text/html` Content-Type, the browser interprets injected HTML/script tags rather than treating the output as JSON. An authenticated attacker can craft a request that executes arbitrary JavaScript in a victim's session. Version 8.0.0.3 contains a fix.

Affected products

• Open-EMR Openemr: before 8.0.0.3 (fixed in 8.0.0.3)

Published 2026-03-25. Last modified 2026-06-17.