The vulnerability in OpenEMR prior to version 8.3.0 is a reflected cross-site scripting (CWE-79) flaw located in the patient portal template import handler. Specifically, the templateHtml GET parameter is not sanitized before being reflected in the HTTP response. This allows an attacker to inject and execute arbitrary JavaScript code in the context of an authenticated user with Forms Administration privileges. The CVSS 3.1 base score is 6.1 (medium severity), with network attack vector, low attack complexity, no privileges required but user interaction needed, and impacts confidentiality and integrity with no availability impact. There are no known exploits in the wild and no patch links provided in the data.

Successful exploitation allows execution of arbitrary JavaScript in the browser of an authenticated user with Forms Administration permissions, which can lead to session hijacking and unauthorized actions within the application. The impact is limited to confidentiality and integrity of the affected user's session and data. There is no indication of availability impact or broader system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced in the provided data, users should monitor the vendor's security advisories for updates. In the meantime, avoid clicking suspicious links and restrict Forms Administration permissions to trusted users only.