CVE-2026-32125 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0.1 contains a stored XSS caused by unescaped user input in Track Anything item names rendered in Dygraph charts, letting authenticated users inject scripts executed by any viewer, exploit requires user to create or edit items.

Severity & Score

Impact

Authenticated users can inject scripts executed by any user viewing the graph, leading to client-side code execution and potential session hijacking.

Mitigation

Update to version 8.0.0.1 or later.

References

• https://github.com/openemr/openemr/security/advisories/GHSA-244w-vxhp-7x99

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner