EIP-2026-110288
PRE-CVEOpenEMR 4.0 - Multiple Cross-Site Scripting Vulnerabilities
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-110288. PoCs published by Houssam Sahli.
AI-analyzed exploit summary This exploit demonstrates multiple reflected XSS vulnerabilities in OpenEMR 4.0.0 by injecting malicious JavaScript payloads into URL parameters. The PoC includes specific URLs with script tags that trigger arbitrary code execution in the context of the affected site.
Description
OpenEMR 4.0 - Multiple Cross-Site Scripting Vulnerabilities
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Houssam Sahli · textwebappsphp
https://www.exploit-db.com/exploits/36034
This exploit demonstrates multiple reflected XSS vulnerabilities in OpenEMR 4.0.0 by injecting malicious JavaScript payloads into URL parameters. The PoC includes specific URLs with script tags that trigger arbitrary code execution in the context of the affected site.
Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target:
OpenEMR 4.0.0
No auth needed
Prerequisites:
Access to the target OpenEMR instance · User interaction to click malicious links
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026