The vulnerability is a stored cross‑site scripting flaw located in interface/forms/eye_mag/report.php of OpenEMR before version 8.3.0. It allows authenticated users with write access to document notes to inject malicious JavaScript into a retinal eye exam document note. When clinicians generate the eye exam patient report, the injected script executes and can expose session cookies, potentially enabling a hijacked session or other malicious client‑side actions. This weakness is categorized as CWE‑79, impacting confidentiality and integrity of user sessions.

OpenEMR, version 8.2.x and earlier, in the core OpenEMR product. Only installations that allow document-note edits for authenticated users are susceptible.

The CVSS score of 5.1 indicates a medium severity level. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate, then obtain write permission on eye exam notes; the bug is exploitable when a clinician generates a report. Considering the required privileges, the overall exploitation risk is moderate, but not negligible for organizations that grant broad edit rights.