Cloudanix VulnDB

CVE-2026-32124

Medium · 5.4

CVSS

5.4

EPSS

0.7%

Published

Mar 11, 2026

CISA due date

—

The record

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, the dynamic code picker AJAX endpoint returns code descriptions (code_text) that are rendered in the front end (e.g. DataTables) without HTML escaping. If an administrator (or user with code management rights) creates or edits a code with a malicious description containing script, that script runs in the browser of every user who uses the picker. This vulnerability is fixed in 8.0.0.1.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities