PT-2026-24840 · Git+1 · Openemr

Pavelkohout396 · Published 2026-03-11 · Updated 2026-03-11 · CVE-2026-32121

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.1

Description OpenEMR is an electronic health records and medical practice management application. A stored cross-site scripting (XSS) issue exists in the prescription CSS/HTML print view via patient demographics. This involves server-side rendering of patient names using a raw PHP echo and client-side DOM-based rendering via jQuery .html() in a separate component (portal/sign/assets/signer api.js). The root cause is unsanitized patient names in patient data. The issue has different sinks, affected components, and trigger actions, requiring independent fixes.

Recommendations Versions prior to 8.0.0.1 should be updated to version 8.0.0.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-32121

GHSA-68FR-XM3V-P4VW

Affected Products

Openemr

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32121.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-68fr-xm3v-p4vw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32121 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32121 · Vendor Advisory
• https://t.me/CVEtracker/47173 · Telegram Post
• https://twitter.com/CVEnew/status/2031867634535334300 · Twitter Post