CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows unauthenticated users to use a feature typically restricted to administrators...

6.1CVSS7AI score0.01184EPSS

Exploits1References1

RedhatCVE•added 2025/05/22 3:39 p.m.•9 views

CVE-2020-5731

In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting...

6.1CVSS6.8AI score0.01143EPSS

Exploits1References1

RedhatCVE•added 2025/05/22 3:39 p.m.•6 views

CVE-2020-5730

In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting...

6.1CVSS6.8AI score0.01143EPSS

Exploits1References1

RedhatCVE•added 2025/03/15 4:40 a.m.•15 views

CVE-2025-25928

A Cross-Site Request Forgery CSRF in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF...

8CVSS8.1AI score0.00265EPSS

Exploits1References1

RedhatCVE•added 2025/03/15 4:38 a.m.•14 views

CVE-2025-25929

A reflected cross-site scripting XSS vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter...

5.4CVSS5.8AI score0.00298EPSS

Exploits1References1

RedhatCVE•added 2025/03/15 4:38 a.m.•12 views

CVE-2025-25925

A stored cross-scripting XSS vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the personName.middleName parameter at /openmrs/admin/patients/shortPatientForm.form...

4.8CVSS6.3AI score0.0032EPSS

Exploits1References1