Openmrs vulnerabilities

Products

• Openmrs 19
• Openmrs-core 4
• Reference Application 4
• Admin Ui Module 3
• Admin Ui Module 3
• Appointment Scheduling Module 2
• Appointment Scheduling Module 2
• Openmrs-module-referenceapplication 2

Newest

• openmrs org.openmrs.module:legacyui-api OpenMRS has Broken Access Control in HL7 Configuration CVE-2026-44715 8.7 HighSeptember 11, 2026
• openmrs openmrs-core OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange CVE-2026-41258 Fix available 9.1 CriticalMay 4, 2026
• openmrs, openmrs openmrs-core +1 more OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload CVE-2026-40076 9.4 CriticalMay 4, 2026
• openmrs, openmrs openmrs-core +1 more OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet CVE-2026-40075 Fix available 8.2 HighMay 4, 2026
• openmrs openmrs-module-fhir2 OpenMRS has Vulnerability in FHIR2 Module Privileges CVE-2025-46823 8.0 HighMay 29, 2025
• openmrs A reflected cross-site scripting (XSS) vulnerability in the component /legacyui... CVE-2025-25929 5.4 MediumMarch 11, 2025
• openmrs A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3... CVE-2025-25928 8.0 HighMarch 11, 2025
• openmrs A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute... CVE-2025-25927 6.8 MediumMarch 11, 2025
• openmrs A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to... CVE-2025-25925 4.8 MediumMarch 11, 2025
• openmrs admin ui module OpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scripting CVE-2020-36636 3.5 LowDecember 27, 2022
• openmrs admin ui module OpenMRS Admin UI Module Manage Privilege Page privilege.gsp cross site scripting CVE-2021-4292 3.5 LowDecember 27, 2022
• openmrs admin ui module OpenMRS Admin UI Module location.gsp cross site scripting CVE-2021-4291 3.5 LowDecember 27, 2022
• openmrs appointment scheduling module OpenMRS Appointment Scheduling Module AppointmentTypeValidator.java validateFieldName cross site scripting CVE-2020-36635 3.5 LowDecember 27, 2022
• openmrs openmrs-module-referenceapplication, reference application +1 more OpenMRS openmrs-module-referenceapplication User App Page UserAppPageController.java post cross site scripting CVE-2021-4289 3.5 LowDecember 27, 2022
• openmrs openmrs-module-referenceapplication, reference application +1 more OpenMRS openmrs-module-referenceapplication userApp.gsp cross site scripting CVE-2021-4288 3.5 LowDecember 27, 2022
• openmrs html form entry ui framework integration module, htmlformentryui +1 more OpenMRS HTML Form Entry UI Framework Integration Module cross site scripting CVE-2021-4284 3.5 LowDecember 27, 2022
• openmrs appointment scheduling module OpenMRS Appointment Scheduling Module Notes AppointmentRequest.java getNotes cross site scripting CVE-2022-4727 3.5 LowDecember 24, 2022
• openmrs, openmrs reference application +1 more An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11... CVE-2021-43094 9.8 CriticalMay 10, 2022
• openmrs, openmrs openmrs-core +1 more Directory Traversal in OpenMRS Startup Filter CVE-2022-23612 7.5 HighFebruary 22, 2022
• openmrs htmlformentry A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form... CVE-2020-24621 8.8 HighSeptember 25, 2020
• openmrs In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross... CVE-2020-5731 6.1 MediumApril 17, 2020
• openmrs In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross... CVE-2020-5730 6.1 MediumApril 17, 2020
• openmrs In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input... CVE-2020-5729 6.1 MediumApril 17, 2020
• openmrs OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl"... CVE-2020-5728 6.1 MediumApril 17, 2020
• openmrs In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly... CVE-2020-5733 6.1 MediumApril 17, 2020
• openmrs In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly... CVE-2020-5732 6.1 MediumApril 17, 2020
• openmrs openmrs-module-htmlformentry OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation). CVE-2017-12795 9.8 CriticalMay 10, 2019
• openmrs OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows... CVE-2018-19276 Public exploit EPSS 98.7% 10.0 CriticalMarch 17, 2019
• openmrs html form entry, reference application +1 more An XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in... CVE-2018-16521 9.8 CriticalSeptember 5, 2018
• openmrs The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference... CVE-2017-12796 9.8 CriticalOctober 23, 2017
• openmrs module reporting The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which... CVE-2017-7990 8.8 HighApril 21, 2017
• openmrs Cross-site request forgery (CSRF) vulnerability in OpenMRS 2.1 Standalone Edition allows remote... CVE-2014-8073 6.8 MediumOctober 23, 2014
• openmrs The administration module in OpenMRS 2.1 Standalone Edition allows remote authenticated users to... CVE-2014-8072 4.0 MediumOctober 23, 2014
• openmrs Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow... CVE-2014-8071 4.3 MediumOctober 23, 2014