CVE-2026-32125CWE-79

OpenEMR: Stored XSS in Track Anything Graphs via Unescaped Dygraph Titles/Labels

Medium · published March 11, 2026

CVSS v3.1
5.4
EPSS
1%
Percentile
50.7
In the wild
Unconfirmed
What it is

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, track/item names from the Track Anything feature are stored from user input (POST) and later rendered in Dygraph charts (titles/labels) using innerHTML or equivalent without escaping. A user who can create or edit Track Anything items can inject script that runs when any user views the corresponding graph. This vulnerability is fixed in 8.0.0.1.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00653 · 50.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-11T20:51Z
EPSS history
Timeline
  • 11 MAR 20:51Z
    OpenEMR: Stored XSS in Track Anything Graphs via Unescaped Dygraph Titles/Labels
    cvelistv5