Threats tagged 'ghsa-4jq4-36fp-37jw'

OpenEMR versions prior to 8.5.0 have a stored cross-site scripting (XSS) vulnerability in the printed_fee_sheet.php component. Authenticated portal patients can inject malicious scripts via unescaped appointment comments, which execute in staff sessions when viewing the patient's fee sheet. This vulnerability allows limited impact on confidentiality and integrity but does not affect availability.