CVE-2025-30161CWE-80

OpenEMR Stored XSS in OpenEMR Bronchitis Form

High · published March 31, 2025

CVSS v4.0

8.4

EPSS

11%

Percentile

95.9

In the wild

Unconfirmed

What it is

OpenEMR is a free and open source electronic health records and medical practice management application. A stored XSS vulnerability in the Bronchitis form component of OpenEMR allows anyone who is able to edit a bronchitis form to steal credentials from administrators. This vulnerability is fixed in 7.0.3.

The record

Technical detail

CVSS v4.0: 8.4 · HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS: 0.10880 · 95.9th percentile
Weakness: CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published: 2025-03-31T16:12Z

EPSS history

Timeline

31 MAR 16:12Z
OpenEMR Stored XSS in OpenEMR Bronchitis Form
cvelistv5