CVE-2026-33932
🟡 Monitoruj
W OpenEMR luka XSS umożliwia wykonanie dowolnego JavaScript w sesji przeglądarki klinicysty.
CVSS
7.6
EPSS
0.0%
Exploit
none
Vendor
open-emr
Opis źródłowy (NVD)
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a stored cross-site scripting vulnerability in the CCDA document preview allows an attacker who can upload or send a CCDA document to execute arbitrary JavaScript in a clinician's browser session when the document is previewed. The XSL stylesheet sanitizes attributes for all other narrative elements but not for `linkHtml`, allowing `href="javascript:..."` and event handler attributes to pass through unchanged. Version 8.0.0.3 patches the issue.
xss
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.6 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.0% |
| Opublikowano (NVD) | 2026-03-26 00:16:39 UTC |
| Ostatnia modyfikacja (NVD) | 2026-03-26 16:27:53 UTC |
Referencje
- https://github.com/openemr/openemr/commit/95e6078889b5399b12b59117f998560cd94bd47d (security-advisories@github.com) [Patch]
- https://github.com/openemr/openemr/releases/tag/v8_0_0_3 (security-advisories@github.com) [Product]
- https://github.com/openemr/openemr/security/advisories/GHSA-g77x-9p3x-2j8f (security-advisories@github.com) [Vendor Advisory]