CVE-2025-25925

A stored cross-scripting XSS vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the personName.middleName parameter at /openmrs/admin/patients/shortPatientForm.form...

CVE-2025-25927

A Cross-Site Request Forgery CSRF in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request...

CVE-2025-25928

A Cross-Site Request Forgery (CSRF) vulnerability exists in the /admin/users/user.form component of Openmrs 2.4.3 Build 0ff0ed . This flaw allows an attacker to execute arbitrary operations via a crafted request. Specifically, an attacker could leverage this vulnerability to elevate a low-privile...

CVE-2025-25928

A Cross-Site Request Forgery CSRF in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF...

PT-2025-10893

Name of the Vulnerable Software and Affected Versions: Openmrs version 2.4.3 Build 0ff0ed Description: A stored cross-scripting XSS issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the personName.middleName parameter at the...

OpenMRS 跨站请求伪造漏洞

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. A security vulnerability exists in OpenMRS version 2.4.3 that stems from a cross-site request forgery issue that could lead to the execution of arbitrary operations...

CVE-2025-25929

A reflected cross-site scripting XSS vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter...

CVE-2025-25929

A reflected cross-site scripting (XSS) vulnerability exists in the OpenMRS version 2.4.3 Build 0ff0ed software. The flaw is located in the /legacyui/quickReportServlet component and is caused by the improper handling of a crafted payload injected into the reportType parameter. This allows an atta...

OpenMRS 安全漏洞

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. A security vulnerability exists in OpenMRS version 2.4.3, which stems from a reflective cross-site scripting issue that could lead to arbitrary JavaScript execution...

Openmrs 跨站脚本漏洞

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. A security vulnerability exists in Openmrs version 2.4.3 Build 0ff0ed, which stems from a stored cross-site scripting issue that could lead to arbitrary web script or HTML execution...

OpenMRS 跨站请求伪造漏洞

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. A cross-site request forgery vulnerability exists in OpenMRS version 2.4.3, which stems from a cross-site request forgery issue that could lead to arbitrary operation execution...

CVE-2025-25929

A reflected cross-site scripting XSS vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter...

CVE-2025-25929

A reflected cross-site scripting XSS vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter...

CVE-2025-25928

A Cross-Site Request Forgery CSRF in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF...

CVE-2025-25927

A Cross-Site Request Forgery CSRF in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request...

CVE-2025-25927

A Cross-Site Request Forgery (CSRF) vulnerability exists in OpenMRS version 2.4.3 Build 0ff0ed . This flaw allows an attacker to execute arbitrary operations by sending a crafted GET request . While the impact is noted as total in technical metrics, specific exploitation links and remediation ste...

CVE-2022-23612

OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subject to arbitrary file exfiltration due to failure to sanitize request when satisfying GET requests for /images & /initfilter/scripts. This...

General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches

Impact We recently underwent Penetration Testing of OpenMRS by a third-party company. Vulnerabilities were found, and fixes have been made and released. We've released security updates that include critical fixes, and so, we strongly recommend upgrading affected modules. This notice applies to al...

GHSA-VPXM-CR3R-PJP9 General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches

Impact We recently underwent Penetration Testing of OpenMRS by a third-party company. Vulnerabilities were found, and fixes have been made and released. We've released security updates that include critical fixes, and so, we strongly recommend upgrading affected modules. This notice applies to al...

PT-2025-5647 · Openmrs · Openmrs Platform +5

Name of the Vulnerable Software and Affected Versions: OpenMRS Platform versions prior to 2.6.11 OpenMRS Platform version 2.5 and earlier, except for version 2.5.14 and later Legacy UI OMOD versions prior to 1.21.0 ID Gen OMOD versions prior to 4.14.0 Address Hierarchy OMOD versions prior to 2.19...