{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-19T14:14:10.857","vulnerabilities":[{"cve":{"id":"CVE-2025-32794","sourceIdentifier":"security-advisories@github.com","published":"2025-05-23T16:15:25.300","lastModified":"2025-07-02T00:45:22.007","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation privileges to inject arbitrary JavaScript code into the system by entering malicious payloads in the First and Last Name fields during patient registration. This code is later executed when viewing the patient's encounter under Orders → Procedure Orders. Version 7.0.3.4 contains a patch for the issue."},{"lang":"es","value":"OpenEMR es una aplicación gratuita y de código abierto para la gestión de historiales médicos electrónicos y consultas médicas. Una vulnerabilidad de cross-site scripting (XSS) almacenado en versiones anteriores a la 7.0.3.4 permite a cualquier usuario autenticado con privilegios para crear pacientes inyectar código JavaScript arbitrario en el sistema mediante la introducción de payloads maliciosos en los campos de Nombre y Apellido durante el registro del paciente. Este código se ejecuta posteriormente al visualizar la consulta del paciente en Órdenes ? Órdenes de procedimiento. La versión 7.0.3.4 incluye un parche para este problema."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.7}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.3.4","matchCriteriaId":"D1D87CF1-6A62-4803-B70B-0286F6398043"}]}]}],"references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-3c27-2m7h-f7rx","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-3c27-2m7h-f7rx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}}]}