CVE-2025-29772CWE-79

OpenEMR allows Reflected XSS in CAMOS new.php

High · published March 31, 2025

CVSS v4.0
7.2
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

OpenEMR is a free and open source electronic health records and medical practice management application. The POST parameter hidden_subcategory is output to the page without being properly processed. This leads to a reflected cross-site scripting (XSS) vul;nerability in CAMOS new.php. This vulnerability is fixed in 7.0.3.

The record
Technical detail
CVSS v4.0
7.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-03-31T16:03Z
EPSS history
Timeline
  • 31 MAR 16:03Z
    OpenEMR allows Reflected XSS in CAMOS new.php
    cvelistv5