What is the CVSS score of CVE-2026-32121?

CVE-2026-32121 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-32121?

OpenEMR instances running version 8.0.0.1 and earlier contain a cross-site scripting vulnerability that could allow attackers to compromise user sessions and steal protected health information (PHI).

How to fix or mitigate CVE-2026-32121?

Within 24 hours: Identify and inventory all OpenEMR deployments and versions in use; assess exposure to internet-facing instances. Within 7 days: Implement WAF rules to filter XSS payloads; restrict OpenEMR access to VPN/internal networks only if clinically feasible; disable non-essential user input features if possible. Within 30 days: Monitor vendor advisories for patch availability; plan upgrade to patched version immediately upon release; conduct security awareness training for staff on phishing/XSS risks.

PHP CVE-2026-32121

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-11 security-advisories@github.com

PHP XSS Openemr

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

CVE Published

Mar 11, 2026 - 21:16 nvd

HIGH 7.7

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, Stored XSS in prescription CSS/HTML print view via patient demographics. That finding involves server-side rendering of patient names via raw PHP echo. This finding involves client-side DOM-based rendering via jQuery .html() in a completely different component (portal/sign/assets/signer_api.js). The two share the same root cause (unsanitized patient names in patient_data), but they have different sinks, different affected components, different trigger actions, and require independent fixes. This vulnerability is fixed in 8.0.0.1.

AnalysisAI

Stored DOM-based cross-site scripting (XSS) in OpenEMR prior to version 8.0.0.1 allows authenticated attackers with low privileges to inject malicious scripts through unsanitized patient names in the portal signing component, which are rendered client-side via jQuery. Successful exploitation requires user interaction and could enable attackers to perform actions in the context of affected users or steal sensitive health information. A patch is available in OpenEMR 8.0.0.1 and later versions.

Technical ContextAI

This vulnerability (CWE-79: Cross-site Scripting (XSS)) exists in the a completely different component. OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, Stored XSS in prescription CSS/HTML print view via patient demographics. That finding involves server-side rendering of patient names via raw PHP echo. This finding involves client-side DOM-based rendering via jQuery .html() in a completely different component (portal/sign/assets/signer_api.js). The two share the same root cause (unsanitized patient names in patient_data),

RemediationAI

Fixed in version 8.0.0.1.. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.