VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Mar 11, 2026· Updated Jun 17, 2026

CVE-2026-32118

CVE-2026-32118

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, stored cross-site scripting (XSS) in the Graphical Pain Map ("clickmap") form allows any authenticated clinician to inject arbitrary JavaScript that executes in the browser of every subsequent user who views the affected encounter form. Because session cookies are not marked HttpOnly, this enables full session hijacking of other users, including administrators. This vulnerability is fixed in 8.0.0.1.

Affected products

3
  • Openemr/Openemr3 versions
    cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*range: <8.0.0.1
    • (no CPE)range: <8.0.0.1
    • (no CPE)range: < 8.0.0.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.