PT-2026-28142 · Openemr · Openemr

CVE-2026-33912 · Publicado 2026-03-25 · Atualizado 2026-03-26

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.3

Description OpenEMR is an electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated attacker could create a malicious form. When submitted by a victim, this form executes arbitrary JavaScript in the victim’s browser session. The attacker crafts the malicious form and relies on a victim to submit it.

Recommendations Update to version 8.0.0.3 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-33912

GHSA-CPPH-949W-W79V

Produtos afetados

Openemr

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33912.json · Exploit
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 · Nota
• https://github.com/openemr/openemr/security/advisories/GHSA-cpph-949w-w79v · Aviso do Fabricante
• https://github.com/openemr/openemr/commit/ae2a9e5edb8c88b9b0dff5969fd3aa98225f047e · Correção
• https://github.com/openemr/openemr/commit/24dd47c3e4936a6ddd064924d17b0273c6ac4b66 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-33912 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037137788789793081 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33912 · Aviso do Fabricante