CVE-2025-31121CWE-79

OpenEMR allows XSS in Patient Image feature

High · published April 1, 2025

CVSS v4.0

7.0

EPSS

17%

Percentile

97.1

In the wild

Unconfirmed

What it is

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 7.0.3.1, the Patient Image feature in OpenEMR is vulnerable to cross-site scripting attacks via the EXIF title in an image. This vulnerability is fixed in 7.0.3.1.

The record

Technical detail

CVSS v4.0: 7.0 · HIGH
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS: 0.17350 · 97.1th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-04-01T14:53Z

EPSS history

Timeline

01 APR 14:53Z
OpenEMR allows XSS in Patient Image feature
cvelistv5