Openmrs
19 CVEs across 15 Openmrs products. Browse Openmrs vulnerabilities, severities, and proof-of-concept exploits.
Openmrs products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41258 | Critical | 9.1 | 2026-05-15 | OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria()… |
CVE-2026-40076 | High | 8.8 | 2026-05-06 | OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the module upload end… |
CVE-2026-40075 | High | 7.5 | 2026-05-05 | OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the `/openmrs/moduleR… |
CVE-2025-46823 | | 2025-05-29 | openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5… | |
CVE-2025-25929 | Medium | 5.4 | 2025-03-11 | A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute ar… |
CVE-2025-25928 | High | 8.0 | 2025-03-11 | A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via… |
CVE-2025-25927 | Medium | 6.8 | 2025-03-11 | A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request. |
CVE-2025-25925 | Medium | 4.8 | 2025-03-11 | A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted p… |
CVE-2021-4292 | Low | 3.5 | 2022-12-27 | A vulnerability was found in OpenMRS Admin UI Module up to 1.4.x. It has been rated as problematic. This issue affects some unknown processing of the file omod… |
CVE-2021-4291 | Low | 3.5 | 2022-12-27 | A vulnerability was found in OpenMRS Admin UI Module up to 1.5.x. It has been declared as problematic. This vulnerability affects unknown code of the file omod… |
CVE-2020-36636 | Low | 3.5 | 2022-12-27 | A vulnerability classified as problematic has been found in OpenMRS Admin UI Module up to 1.4.x. Affected is the function sendErrorMessage of the file omod/src… |
CVE-2020-36635 | Low | 3.5 | 2022-12-27 | A vulnerability was found in OpenMRS Appointment Scheduling Module up to 1.12.x. It has been classified as problematic. This affects the function validateField… |
CVE-2022-4727 | Low | 3.5 | 2022-12-27 | A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of th… |
CVE-2021-4289 | Low | 3.5 | 2022-12-27 | A vulnerability classified as problematic was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. Affected by this vulnerability is the function… |
CVE-2021-4288 | Low | 3.5 | 2022-12-27 | A vulnerability was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. It has been rated as problematic. This issue affects some unknown proces… |
CVE-2021-4284 | Low | 3.5 | 2022-12-27 | A vulnerability classified as problematic has been found in OpenMRS HTML Form Entry UI Framework Integration Module up to 1.x. This affects an unknown part. Th… |
CVE-2021-43094 | Critical | 9.8 | 2022-05-10 | An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on ar… |
CVE-2022-23612 | High | 7.5 | 2022-02-22 | OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subje… |
CVE-2020-24621 | High | 8.8 | 2020-09-25 | A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS. By leveraging path trav… |
CVE-2020-5733 | Medium | 6.1 | 2020-04-17 | In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts… |
CVE-2020-5732 | Medium | 6.1 | 2020-04-17 | In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts… |
CVE-2020-5731 | Medium | 6.1 | 2020-04-17 | In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting. |
CVE-2020-5730 | Medium | 6.1 | 2020-04-17 | In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting. |
CVE-2020-5729 | Medium | 6.1 | 2020-04-17 | In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS. Any page that is ab… |
CVE-2020-5728 | Medium | 6.1 | 2020-04-17 | OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). There is insufficient… |
CVE-2017-12795 | Critical | 9.8 | 2019-05-10 | OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation). |
CVE-2018-19276 | Critical | 9.8 | 2019-03-21 | OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the… |
CVE-2018-16521 | Critical | 9.8 | 2018-09-05 | An XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0. |
CVE-2017-12796 | Critical | 9.8 | 2017-10-23 | The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when des… |
CVE-2017-7990 | High | 8.8 | 2017-04-21 | The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a… |
CVE-2014-8073 | | 2014-10-23 | Cross-site request forgery (CSRF) vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the authentication of administrators for re… | |
CVE-2014-8072 | | 2014-10-23 | The administration module in OpenMRS 2.1 Standalone Edition allows remote authenticated users to obtain read access via a direct request to /admin. | |
CVE-2014-8071 | | 2014-10-23 | Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1)… |