What’s Vulnerable › Vulnerabilities

CVE-2021-32103

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-07 · updated 2026-06-17
• Weakness: CWE-79

Description

A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter.

Affected products

• openemr: through 5.0.2.1

References

• https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability
• https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431
• https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592
• https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execution-in-patient-portal
• https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability
• https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431
• https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592
• https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execution-in-patient-portal

Get alerted when CVE-2021-32103 or the next vulnerability affects your stack