PT-2026-21822 · Openemr · Openemr

Bradymiller · Publicado 2026-02-25 · Atualizado 2026-02-25 · CVE-2026-21443

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. Before version 8.0.0, the xl() translation function does not properly escape strings. The application includes wrapper functions for escaping in different contexts (xlt() for HTML, xla() for attributes, xlj() for JavaScript), but the xl() function’s output is sometimes used directly without escaping. If an attacker can inject malicious content into the translation database, this could lead to cross-site scripting (XSS). The xl() function is used to retrieve translated strings.

Recommendations Update to version 8.0.0 or later.

Exploit

Correção

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-116

Identificadores relacionados

CVE-2026-21443

GHSA-3F9J-CQJJ-7H46

Produtos afetados

Openemr

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21443.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-3f9j-cqjj-7h46 · Aviso do Fabricante
• https://github.com/openemr/openemr/commit/b1e3fe8a9ed8bcaf17e0b73d7fad5434f9fe36da · Correção
• https://twitter.com/CVEnew/status/2026641389950251218 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-21443 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-21443 · Nota de Segurança