PT-2026-24840 · Git+1 · Openemr

Pavelkohout396 · Publicado 2026-03-11 · Atualizado 2026-03-11 · CVE-2026-32121

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.1

Description OpenEMR is an electronic health records and medical practice management application. A stored cross-site scripting (XSS) issue exists in the prescription CSS/HTML print view via patient demographics. This involves server-side rendering of patient names using a raw PHP echo and client-side DOM-based rendering via jQuery .html() in a separate component (portal/sign/assets/signer api.js). The root cause is unsanitized patient names in patient data. The issue has different sinks, affected components, and trigger actions, requiring independent fixes.

Recommendations Versions prior to 8.0.0.1 should be updated to version 8.0.0.1 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-32121

GHSA-68FR-XM3V-P4VW

Produtos afetados

Openemr

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32121.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-68fr-xm3v-p4vw · Aviso do Fabricante
• https://t.me/CVEtracker/47173 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-32121 · Nota de Segurança
• https://twitter.com/CVEnew/status/2031867634535334300 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32121 · Aviso do Fabricante