PT-2026-24846 · Git+1 · Openemr

Pavelkohout396 · Publicado 2026-03-11 · Atualizado 2026-03-11 · CVE-2026-32125

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.1

Description OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, names associated with items in the 'Track Anything' feature are taken directly from user input (via POST requests) and displayed in Dygraph charts (titles and labels) without proper sanitization. This allows a user with the ability to create or edit 'Track Anything' items to inject malicious script that will execute when any user views the corresponding graph. The issue involves the use of innerHTML or similar methods without escaping, leading to potential cross-site scripting (XSS). The vulnerable component is the rendering of track/item names in Dygraph charts.

Recommendations Update OpenEMR to version 8.0.0.1 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-32125

GHSA-244W-VXHP-7X99

Produtos afetados

Openemr

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32125.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-244w-vxhp-7x99 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32125 · Nota de Segurança
• https://twitter.com/CVEnew/status/2031867630173229438 · Publicação no Twitter
• https://t.me/CVEtracker/47177 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-32125 · Aviso do Fabricante