PT-2026-24845 · Git+1 · Openemr

Pavelkohout396 · CVE-2026-32124 · Published 2026-03-11 · Updated 2026-03-11

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.1

Description OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, the dynamic code picker ''/ajax/dynamic code picker'' endpoint returns code descriptions (code text) that are rendered in the front end (e.g., DataTables) without HTML escaping. If an administrator or a user with code management rights creates or edits a code with a malicious description containing a script, that script executes in the browser of every user who uses the picker.

Recommendations Update to version 8.0.0.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-32124

GHSA-9HW7-22MR-QHFC

Affected Products

Openemr

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32124.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-9hw7-22mr-qhfc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32124 · Security Note
• https://t.me/CVEtracker/47176 · Telegram Post
• https://twitter.com/CVEnew/status/2031867631280550094 · Twitter Post