Skip to content
Noroxi

OpenMRS records

31 published records for vendor openmrs.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 3.2%
Pre-auth RCE
1
With a fix record
29%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 22
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

31 records
  • CVE-2018-19276
    69This week

    OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitra

    CriticalCVSS 9.8WeaponizedEPSS 98%

    openmrs · openmrsMar 21, 2019

  • CVE-2017-12796
    40Plan

    The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenti

    CriticalCVSS 9.8No exploitEPSS 4%

    openmrs · openmrsOct 23, 2017

  • CVE-2017-12795
    40Plan

    OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation).

    CriticalCVSS 9.8No exploitEPSS 2%

    openmrs · openmrs-module-htmlformentryMay 10, 2019

  • CVE-2018-16521
    40Plan

    An XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0.

    CriticalCVSS 9.8No exploitEPSS 1%

    openmrs · html form entrySep 5, 2018

  • CVE-2021-43094
    39Monitor

    An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via

    CriticalCVSS 9.8No exploitEPSS 1%

    openmrs · openmrsMay 10, 2022

  • CVE-2026-40076
    37Monitor

    OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload

    CriticalCVSS 9.4No exploitEPSS 0%

    openmrs · openmrsMay 6, 2026

  • CVE-2020-24621
    36Monitor

    A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS.

    HighCVSS 8.8No exploitEPSS 3%

    openmrs · htmlformentrySep 25, 2020

  • CVE-2017-7990
    35Monitor

    The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert

    HighCVSS 8.8No exploitEPSS 1%

    openmrs · openmrs module reportingApr 20, 2017

  • CVE-2026-40075
    32Monitor

    OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet

    HighCVSS 8.2No exploitEPSS 0%

    openmrs · openmrsMay 5, 2026

  • CVE-2025-25928
    32Monitor

    A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitr

    HighCVSS 8.0No exploitEPSS 0%

    openmrs · openmrsMar 11, 2025

  • CVE-2022-23612
    31Monitor

    Directory Traversal in OpenMRS Startup Filter

    HighCVSS 7.5No exploitEPSS 1%

    openmrs · openmrsFeb 22, 2022

  • CVE-2014-8073
    27Monitor

    Cross-site request forgery (CSRF) vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the authentication of ad

    MediumCVSS 6.8No exploitEPSS 1%

    openmrs · openmrsOct 23, 2014

  • CVE-2025-25927
    27Monitor

    A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request

    MediumCVSS 6.8No exploitEPSS 0%

    openmrs · openmrsMar 11, 2025

  • CVE-2020-5732
    24Monitor

    In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthentic

    MediumCVSS 6.1No exploitEPSS 1%

    openmrs · openmrsApr 17, 2020

  • CVE-2020-5733
    24Monitor

    In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenti

    MediumCVSS 6.1No exploitEPSS 1%

    openmrs · openmrsApr 17, 2020

  • CVE-2020-5731
    24Monitor

    In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting.

    MediumCVSS 6.1No exploitEPSS 1%

    openmrs · openmrsApr 17, 2020

  • CVE-2020-5730
    24Monitor

    In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting.

    MediumCVSS 6.1No exploitEPSS 1%

    openmrs · openmrsApr 17, 2020

  • CVE-2020-5729
    24Monitor

    In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS.

    MediumCVSS 6.1No exploitEPSS 1%

    openmrs · openmrsApr 17, 2020

  • CVE-2020-5728
    24Monitor

    OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm).

    MediumCVSS 6.1No exploitEPSS 1%

    openmrs · openmrsApr 17, 2020

  • CVE-2021-4289
    24Monitor

    OpenMRS openmrs-module-referenceapplication User App Page UserAppPageController.java post cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    openmrs · reference applicationDec 27, 2022

  • CVE-2021-4284
    24Monitor

    OpenMRS HTML Form Entry UI Framework Integration Module cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    openmrs · htmlformentryuiDec 27, 2022

  • CVE-2020-36636
    24Monitor

    OpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    openmrs · admin ui moduleDec 27, 2022

  • CVE-2022-4727
    24Monitor

    OpenMRS Appointment Scheduling Module Notes AppointmentRequest.java getNotes cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    openmrs · appointment scheduling moduleDec 27, 2022

  • CVE-2021-4288
    24Monitor

    OpenMRS openmrs-module-referenceapplication userApp.gsp cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    openmrs · reference applicationDec 27, 2022

  • CVE-2021-4291
    24Monitor

    OpenMRS Admin UI Module location.gsp cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    openmrs · admin ui moduleDec 27, 2022