The vulnerability allows an attacker to inject and execute arbitrary JavaScript in the victim’s browser session. By crafting a malicious form that references the vulnerable reportID parameter in ajax_download.php, an authenticated attacker can cause the victim’s browser to run attacker supplied code when the form is submitted. This may lead to data theft, session hijacking, or other client‑side attacks. The weakness is a reflected XSS flaw (CWE‑79).

The flaw exists in OpenEMR for all releases prior to 8.0.0.3. Any installation of the OpenEMR application that has not been upgraded to version 8.0.0.3 or later is vulnerable. The affected product is the OpenEMR electronic health records system.

The CVSS score of 5.4 indicates moderate impact. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability requires an authenticated user and relies on the victim’s browser executing injected code, so the attack vector is web‑based via the application’s interface. The issue is not listed in CISA’s KEV catalog, but since the flaw allows arbitrary script execution, any user with a valid session could be impacted if they visit a crafted page.