Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, DOM-based stored XSS in the jQuery SearchHighlight plugin (`library/js/SearchHighlight.js`) allows an authenticated user with encounter form write access to inject arbitrary JavaScript that executes in another clinician's browser session when they use the search/find feature on the Custom Report page. The plugin reverses server-side HTML entity encoding by reading decoded text from DOM text nodes, concatenating it into a raw HTML string, and passing it to jQuery's `$()` constructor for HTML parsing. Version 8.0.0.2 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-32119 OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, DOM-based stored XSS in the jQuery SearchHi… https://www.cve.org/CVERecord?id=CVE-2026-32119
Post summary
The snippet announces CVE-2026-32119, a DOM‑based stored XSS in OpenEMR’s jQuery SearchHi component before version 8.0.0.2, without providing any PoC, exploit, patch, or evidence of active use.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-32119 - OpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page Intel Report: https://ift.tt/DudWTpK
Post summary
The post discloses CVE-2026-32119, a Stored DOM XSS in OpenEMR involving SearchHighlight text-node reconstruction on the Custom Report page, and references an Intel report.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | open-emr | openemr | - | - | - |