{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-23T03:35:11.014","vulnerabilities":[{"cve":{"id":"CVE-2026-32119","sourceIdentifier":"security-advisories@github.com","published":"2026-03-19T20:16:13.900","lastModified":"2026-06-17T10:35:10.183","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, DOM-based stored XSS in the jQuery SearchHighlight plugin (`library/js/SearchHighlight.js`) allows an authenticated user with encounter form write access to inject arbitrary JavaScript that executes in another clinician's browser session when they use the search/find feature on the Custom Report page. The plugin reverses server-side HTML entity encoding by reading decoded text from DOM text nodes, concatenating it into a raw HTML string, and passing it to jQuery's `$()` constructor for HTML parsing. Version 8.0.0.2 fixes the issue."},{"lang":"es","value":"OpenEMR es una aplicación de gestión de registros de salud electrónicos y práctica médica de código abierto y gratuita. Antes de la versión 8.0.0.2, un XSS almacenado basado en DOM en el plugin jQuery SearchHighlight ('library/js/SearchHighlight.js') permite a un usuario autenticado con acceso de escritura a formularios de encuentro inyectar JavaScript arbitrario que se ejecuta en la sesión del navegador de otro clínico cuando utilizan la función de búsqueda/encontrar en la página de Informes Personalizados. El plugin revierte la codificación de entidades HTML del lado del servidor leyendo texto decodificado de nodos de texto DOM, concatenándolo en una cadena HTML sin procesar y pasándolo al constructor `$()` de jQuery para el análisis HTML. La versión 8.0.0.2 corrige el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"openemr","product":"openemr","versions":[{"version":"< 8.0.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-19T20:39:22.528820Z","id":"CVE-2026-32119","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.0.2","matchCriteriaId":"C78F19AD-BD18-4F61-8B1C-DD099DBC6D34"}]}]}],"references":[{"url":"https://github.com/openemr/openemr/commit/70a41122c6d75ebcd219ba2a2535e93a6c188151","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-q283-5j7f-r6hp","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-q283-5j7f-r6hp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}}]}