Threats tagged 'ghsa-7w4f-639v-v9jp'

OpenEMR versions prior to 8.3.0 contain a stored cross-site scripting (XSS) vulnerability in the file interface/forms/eye_mag/report.php. This flaw allows authenticated users with document-note write permissions to inject malicious JavaScript code into retina document notes. When clinicians generate the Eye Exam patient report, the injected script executes, potentially exposing session cookies. The vulnerability has a medium severity rating with a CVSS score of 5.4.