OpenEMR is a free and open source electronic health records and medical practice management application. OpenEMR allows reflected cross-site scripting (XSS) in the AJAX Script interface\super\layout_listitems_ajax.php via the target parameter. This vulnerability is fixed in 7.0.3.
References
| Link | Resource |
|---|---|
| https://github.com/openemr/openemr/commit/6cb70595f65decfbdd03e70b49acc414e03744b8 | Patch |
| https://github.com/openemr/openemr/security/advisories/GHSA-fwfv-8583-6rr7 | Exploit Vendor Advisory |
| https://github.com/openemr/openemr/security/advisories/GHSA-fwfv-8583-6rr7 | Exploit Vendor Advisory |
Configurations
History
30 Apr 2025, 16:08
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.6 |
| First Time |
Open-emr openemr
Open-emr |
|
| CPE | cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:* | |
| References | () https://github.com/openemr/openemr/commit/6cb70595f65decfbdd03e70b49acc414e03744b8 - Patch | |
| References | () https://github.com/openemr/openemr/security/advisories/GHSA-fwfv-8583-6rr7 - Exploit, Vendor Advisory |
31 Mar 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
31 Mar 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-31 16:15
Updated : 2025-04-30 16:08
NVD link : CVE-2025-30149
Mitre link : CVE-2025-30149
JSON object : View
Products Affected
open-emr
- openemr
CWE
No CWE.