CVE-2026-32125

{"id": "CVE-2026-32125", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2026-03-11T21:16:18.540", "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-244w-vxhp-7x99", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, track/item names from the Track Anything feature are stored from user input (POST) and later rendered in Dygraph charts (titles/labels) using innerHTML or equivalent without escaping. A user who can create or edit Track Anything items can inject script that runs when any user views the corresponding graph. This vulnerability is fixed in 8.0.0.1."}, {"lang": "es", "value": "OpenEMR es una aplicaci\u00f3n gratuita y de c\u00f3digo abierto para la gesti\u00f3n de registros m\u00e9dicos electr\u00f3nicos y la pr\u00e1ctica m\u00e9dica. Previo a la versi\u00f3n 8.0.0.1, los nombres de pistas/elementos de la funci\u00f3n 'Track Anything' se almacenan a partir de la entrada del usuario (POST) y luego se renderizan en gr\u00e1ficos Dygraph (t\u00edtulos/etiquetas) utilizando innerHTML o equivalente sin escape. Un usuario que puede crear o editar elementos de 'Track Anything' puede inyectar scripts que se ejecutan cuando cualquier usuario ve el gr\u00e1fico correspondiente. Esta vulnerabilidad se corrige en la versi\u00f3n 8.0.0.1."}], "lastModified": "2026-03-13T15:47:01.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "136D07EE-9108-423B-AD86-E9E901940C17", "versionEndExcluding": "8.0.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}