CVE-2026-32119 is a DOM-based stored Cross-Site Scripting (XSS) vulnerability affecting OpenEMR versions prior to 8.0.0.2. It allows an authenticated user with encounter form write access to inject arbitrary JavaScript, which executes in another clinician's browser when they use the search/find feature on the Custom Report page. Rated Medium (CVSS 4.4), this vulnerability requires low privileges and user interaction, potentially leading to limited confidentiality and integrity impact. There is currently no evidence of active exploitation, public exploit code, or significant community attention for this flaw.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 8.0.0.2CPE matchmatch criteria | cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.