CVE-2026-32124 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0.1 contains a stored XSS caused by lack of HTML escaping in dynamic code picker AJAX endpoint, letting administrators or users with code management rights execute scripts in other users' browsers, exploit requires code management privileges.

Severity & Score

Impact

Attackers with code management rights can execute scripts in other users' browsers, potentially stealing session data or performing actions on their behalf.

Mitigation

Update to version 8.0.0.1 or later.

References

• https://github.com/openemr/openemr/security/advisories/GHSA-9hw7-22mr-qhfc

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner