CVE-2025-25927

A Cross-Site Request Forgery CSRF in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request...

OpenMRS 跨站请求伪造漏洞

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. A cross-site request forgery vulnerability exists in OpenMRS version 2.4.3, which stems from a cross-site request forgery issue that could lead to arbitrary operation execution...

OpenMRS 安全漏洞

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. A security vulnerability exists in OpenMRS version 2.4.3, which stems from a reflective cross-site scripting issue that could lead to arbitrary JavaScript execution...

CVE-2025-25929

A reflected cross-site scripting XSS vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter...

Openmrs 跨站脚本漏洞

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. A security vulnerability exists in Openmrs version 2.4.3 Build 0ff0ed, which stems from a stored cross-site scripting issue that could lead to arbitrary web script or HTML execution...

CVE-2025-25929

A reflected cross-site scripting XSS vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter...

CVE-2025-25929

CVE-2025-25929 describes a reflected cross-site scripting (XSS) vulnerability in OpenMRS 2.4.3 Build 0ff0ed, affecting the component /legacyui/quickReportServlet. The issue allows an attacker to inject arbitrary JavaScript that executes in the context of a user’s browser via a crafted payload in ...

CVE-2025-25927

OpenMRS CVE-2025-25927 affects OpenMRS 2.4.3 Build 0ff0ed. The vulnerability is a Cross-Site Request Forgery (CSRF) that allows an attacker to trigger arbitrary operations through a crafted GET request. According to the CVSS information, this is a network-accessible issue with low attack complexi...

CVE-2022-23612

OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subject to arbitrary file exfiltration due to failure to sanitize request when satisfying GET requests for /images & /initfilter/scripts. This...

GHSA-VPXM-CR3R-PJP9 General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches

Impact We recently underwent Penetration Testing of OpenMRS by a third-party company. Vulnerabilities were found, and fixes have been made and released. We've released security updates that include critical fixes, and so, we strongly recommend upgrading affected modules. This notice applies to al...

General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches

Impact We recently underwent Penetration Testing of OpenMRS by a third-party company. Vulnerabilities were found, and fixes have been made and released. We've released security updates that include critical fixes, and so, we strongly recommend upgrading affected modules. This notice applies to al...

PT-2025-5647 · Openmrs · Openmrs Platform +5

Name of the Vulnerable Software and Affected Versions: OpenMRS Platform versions prior to 2.6.11 OpenMRS Platform version 2.5 and earlier, except for version 2.5.14 and later Legacy UI OMOD versions prior to 1.21.0 ID Gen OMOD versions prior to 4.14.0 Address Hierarchy OMOD versions prior to 2.19...

OpenMRS 安全漏洞

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. A security vulnerability exists in OpenMRS versions 2.4.2 and 2.12.2, which can be exploited to launch an attack via the "attachments" page in patient...

CVE-2020-36635

A vulnerability was found in OpenMRS Appointment Scheduling Module up to 1.12.x. It has been classified as problematic. This affects the function validateFieldName of the file api/src/main/java/org/openmrs/module/appointmentscheduling/validator/AppointmentTypeValidator.java. The manipulation lead...

CVE-2021-4291

A vulnerability was found in OpenMRS Admin UI Module up to 1.5.x. It has been declared as problematic. This vulnerability affects unknown code of the file omod/src/main/webapp/pages/metadata/locations/location.gsp. The manipulation leads to cross site scripting. The attack can be initiated...

CVE-2021-4292

A vulnerability was found in OpenMRS Admin UI Module up to 1.4.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/metadata/privileges/privilege.gsp of the component Manage Privilege Page. The manipulation leads to cross site...

CVE-2020-36635

A vulnerability was found in OpenMRS Appointment Scheduling Module up to 1.12.x. It has been classified as problematic. This affects the function validateFieldName of the file api/src/main/java/org/openmrs/module/appointmentscheduling/validator/AppointmentTypeValidator.java. The manipulation lead...

CVE-2020-36636

A vulnerability classified as problematic has been found in OpenMRS Admin UI Module up to 1.4.x. Affected is the function sendErrorMessage of the file omod/src/main/java/org/openmrs/module/adminui/page/controller/systemadmin/accounts/AccountPageController.java of the component Account Setup...

CVE-2021-4292

A vulnerability was found in OpenMRS Admin UI Module up to 1.4.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/metadata/privileges/privilege.gsp of the component Manage Privilege Page. The manipulation leads to cross site...

CVE-2020-36636

A vulnerability classified as problematic has been found in OpenMRS Admin UI Module up to 1.4.x. Affected is the function sendErrorMessage of the file omod/src/main/java/org/openmrs/module/adminui/page/controller/systemadmin/accounts/AccountPageController.java of the component Account Setup...