XSS in Open-Emr Openemr
CVE-2025-32794
OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation privileges to inject arbitrary JavaScript code into the system by entering malicious payloads in the First and Last Name fields during patient registration. This code is later executed when viewing the patient's encounter under Orders → Procedure Orders. Version 7.0.3.4 contains a patch for the issue.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.071 (93.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N.
Affected products
- Open-emr Openemr
- Openemr — versions < 7.0.3.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-32794?
- CVE-2025-32794 is a high-severity vulnerability in Open-Emr Openemr, classified under Cross-site Scripting. CVSS score: 7.6/10. Published 2025-05-23.
- How severe is CVE-2025-32794?
- High severity. CVSS v3 base score is 7.6 out of 10.
- Is CVE-2025-32794 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.