CVE-2025-32794

Katalog CVE

CVSS 7.6 · High EPSS 10,1%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada open-emr openemr. Skor CVSS 3.1 7.6 (High) menurut github.com.

Deskripsi (NVD)

OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation privileges to inject arbitrary JavaScript code into the system by entering malicious payloads in the First and Last Name fields during patient registration. This code is later executed when viewing the patient's encounter under Orders → Procedure Orders. Version 7.0.3.4 contains a patch for the issue.

Rincian

Terbit di NVD

23 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.6 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

10,1% peluang dieksploitasi; lebih tinggi dari 95,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openemr/openemr/security/advisories/GHSA-3c27-2m7h-f7rx exploit · advisory vendor