Login Request a demo
OP
Product
Openmrs
by Openmrs · last CVE May 6, 2026
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities19In the news0Timeline
Severity mix
Critical 3High 4Medium 9Low 0
Severity
All severities19Critical3High4Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Openmrs to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-25927
6.8
0%
Mar 11
A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request
Affected: 2.4.3
CVE-2020-5733
6.1
1%
Apr 17
In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it
Affected: through 2.9.0
CVE-2020-5732
6.1
1%
Apr 17
In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it
Affected: through 2.9.0
CVE-2020-5731
6.1
1%
Apr 17
In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting
Affected: through 2.9.0
CVE-2020-5730
6.1
1%
Apr 17
In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting
Affected: through 2.9.0
CVE-2020-5729
6.1
1%
Apr 17
In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS
Affected: through 2.9.0
CVE-2020-5728
6.1
1%
Apr 17
OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm)
Affected: through 2.9.0
CVE-2025-25929
5.4
0%
Mar 11
A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript…
Affected: 2.4.3
CVE-2025-25925
4.8
0%
Mar 11
A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the…
Affected: 2.4.3
Showing 9