CVE-2026-40507 in OpenEMR
Summary
by MITRE • 08/19/2026
OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any authenticated user with Forms Administration permissions who visits the link, enabling session hijacking.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.