CVE-2026-32127

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32127", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T22:19:36.545Z", "datePublished": "2026-03-11T20:53:09.610Z", "dateUpdated": "2026-03-12T14:16:56.356Z"}, "containers": {"cna": {"title": "SQL Injection Vulnerability in ajax graphs library (OpenEMR)", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/openemr/openemr/security/advisories/GHSA-v8q6-h79f-736x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-v8q6-h79f-736x"}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"version": "< 8.0.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T20:53:09.610Z"}, "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, OpenEMR contains a SQL injection vulnerability in the ajax graphs library that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the ajax graphs library. This vulnerability is fixed in 8.0.0.1."}], "source": {"advisory": "GHSA-v8q6-h79f-736x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T14:16:12.995707Z", "id": "CVE-2026-32127", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:16:56.356Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32127", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-12T14:16:12.995707Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:16:52.598Z"}}], "cna": {"title": "SQL Injection Vulnerability in ajax graphs library (OpenEMR)", "source": {"advisory": "GHSA-v8q6-h79f-736x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0.1"}]}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-v8q6-h79f-736x", "name": "https://github.com/openemr/openemr/security/advisories/GHSA-v8q6-h79f-736x", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, OpenEMR contains a SQL injection vulnerability in the ajax graphs library that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the ajax graphs library. This vulnerability is fixed in 8.0.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T20:53:09.610Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32127", "state": "PUBLISHED", "dateUpdated": "2026-03-12T14:16:56.356Z", "dateReserved": "2026-03-10T22:19:36.545Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T20:53:09.610Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openemr", "vendor": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "matchCriteriaId": "136D07EE-9108-423B-AD86-E9E901940C17", "versionEndExcluding": "8.0.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, OpenEMR contains a SQL injection vulnerability in the ajax graphs library that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the ajax graphs library. This vulnerability is fixed in 8.0.0.1."}, {"lang": "es", "value": "OpenEMR es una aplicaci\u00f3n de gesti\u00f3n de registros m\u00e9dicos electr\u00f3nicos y pr\u00e1ctica m\u00e9dica de c\u00f3digo abierto y gratuita. Antes de 8.0.0.1, OpenEMR contiene una vulnerabilidad de inyecci\u00f3n SQL en la biblioteca de gr\u00e1ficos ajax que puede ser explotada por atacantes autenticados. La vulnerabilidad existe debido a una validaci\u00f3n de entrada insuficiente en la biblioteca de gr\u00e1ficos ajax. Esta vulnerabilidad est\u00e1 corregida en 8.0.0.1."}], "id": "CVE-2026-32127", "lastModified": "2026-06-17T10:35:11.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32127", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T14:16:12.995707Z", "version": "2.0.3"}}]}, "published": "2026-03-11T21:16:18.900", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-v8q6-h79f-736x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.0.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openemr", "source": "cna", "vendor": "openemr"}, "product": "openemr", "vendor": "openemr"}], "analysis": {"en": {"generated_at": "2026-04-17T11:35:40.086074+00:00", "value": {"mitigation_remediation": ["Upgrade OpenEMR to version 8.0.0.1 or later.", "Restrict or disable access to the ajax graphs functionality for accounts that do not need it.", "Monitor application logs for unexpected SQL queries or anomalous activity on the Ajax graphs endpoint."], "summary": {"action": "Patch ASAP", "impact": "SQL Injection allowing authenticated attackers to access or manipulate data"}, "threat_synthesis": {"affected_systems": "The issue affects installations of the OpenEMR electronic health records application that are running any version older than 8.0.0.1. The fix was introduced in release 8.0.0.1, so systems not yet updated remain vulnerable.", "description_and_impact": "OpenEMR contains a CWE-89 SQL injection flaw in the ajax graphs library that permits an authenticated attacker to inject arbitrary SQL. The absence of proper input validation allows malicious queries to be executed against the database, potentially exposing sensitive patient information or altering records. The vulnerability is strictly limited to users who can authenticate to the system, so it does not grant unauthenticated access.", "risk_and_exploitability": "The CVSS score of 8.8 designates the flaw as high severity, but the EPSS score of less than 1\u202f% suggests that exploitation is currently unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploitation. Attackers need legitimate credentials to reach the Ajax graphs endpoint, so the attack vector involves authenticated users submitting malicious payloads to that endpoint. The high severity combined with the sensitive nature of medical data means that, if exploited, the potential impact remains significant."}}}}, "created": "2026-03-12T09:55:50.496198+00:00", "updated": "2026-04-17T11:45:06.223976+00:00", "vendors": ["openemr", "openemr$PRODUCT$openemr"]}