Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x prior to 5.0.2.1 ia the id parameter.
open-emr openemr