Login Request a demo
OP
Vendor
Openmrs
12 products with CVEs on record
38
CVEs
0
On KEV
0
New 30D
Products
OP
Openmrs
Openmrs
9.8
19 CVEs0 on KEV0 new
RA
Reference Application
Openmrs
9.8
4 CVEs0 on KEV0 new
AU
Admin UI Module
Openmrs
6.1
3 CVEs0 on KEV0 new
OP
openmrs-core
openmrs
9.1
3 CVEs0 on KEV0 new
AS
Appointment Scheduling Module
Openmrs
6.1
2 CVEs0 on KEV0 new
HF
Html Form Entry
Openmrs
9.8
1 CVEs0 on KEV0 new
HT
Htmlformentry
Openmrs
8.8
1 CVEs0 on KEV0 new
HT
Htmlformentryui
Openmrs
6.1
1 CVEs0 on KEV0 new
OP
openmrs-module-fhir2
openmrs
8.0
1 CVEs0 on KEV0 new
OP
Openmrs-module-htmlformentry
Openmrs
9.8
1 CVEs0 on KEV0 new
OM
Openmrs Module Reporting
Openmrs
8.8
1 CVEs0 on KEV0 new
OR
org.openmrs.module:legacyui-api
openmrs
8.7
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-44715
OR
org.openmrs.module:legacyui-api
openmrs
8.7
0%
Sep 11OpenMRS has Broken Access Control in HL7 Configuration
CVE-2026-41258
OP
openmrs-core
openmrs
9.1
0%
May 15OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange
CVE-2026-40076
OP
openmrs-core
openmrs
8.8
1%
May 6OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload
CVE-2026-40075
OP
openmrs-core
openmrs
7.5
1%
May 5OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet
CVE-2025-46823
OP
openmrs-module-fhir2
openmrs
8.0
0%
May 29OpenMRS has Vulnerability in FHIR2 Module Privileges
CVE-2025-25925
OP
Openmrs
Openmrs
4.8
0%
Mar 11A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the…
CVE-2025-25929
OP
Openmrs
Openmrs
5.4
0%
Mar 11A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript…
CVE-2025-25928
OP
Openmrs
Openmrs
8.0
0%
Mar 11A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request
CVE-2025-25927
OP
Openmrs
Openmrs
6.8
0%
Mar 11A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request
CVE-2021-4292
AU
Admin UI Module
Openmrs
6.1
1%
Dec 27A vulnerability was found in OpenMRS Admin UI Module up to 1.4.x
CVE-2021-4291
AU
Admin UI Module
Openmrs
6.1
1%
Dec 27A vulnerability was found in OpenMRS Admin UI Module up to 1.5.x
CVE-2020-36636
AU
Admin UI Module
Openmrs
6.1
1%
Dec 27A vulnerability classified as problematic has been found in OpenMRS Admin UI Module up to 1.4.x
CVE-2020-36635
AS
Appointment Scheduling Module
Openmrs
5.4
1%
Dec 27A vulnerability was found in OpenMRS Appointment Scheduling Module up to 1.12.x
CVE-2022-4727
AS
Appointment Scheduling Module
Openmrs
6.1
1%
Dec 27A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x
CVE-2021-4289
RA
Reference Application
Openmrs
6.1
1%
Dec 27A vulnerability classified as problematic was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x
CVE-2021-4288
RA
Reference Application
Openmrs
6.1
1%
Dec 27A vulnerability was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x
CVE-2021-4284
HT
Htmlformentryui
Openmrs
6.1
1%
Dec 27A vulnerability classified as problematic has been found in OpenMRS HTML Form Entry UI Framework Integration Module up to 1.x
CVE-2021-43094
OP
Openmrs
Openmrs
9.8
1%
May 10An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters…
CVE-2022-23612
OP
Openmrs
Openmrs
7.5
2%
Feb 22OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system
CVE-2020-24621
HT
Htmlformentry
Openmrs
8.8
3%
Sep 25A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS
CVE-2020-5733
OP
Openmrs
Openmrs
6.1
1%
Apr 17In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it
CVE-2020-5732
OP
Openmrs
Openmrs
6.1
1%
Apr 17In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it
CVE-2020-5731
OP
Openmrs
Openmrs
6.1
1%
Apr 17In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting
CVE-2020-5730
OP
Openmrs
Openmrs
6.1
1%
Apr 17In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting
CVE-2020-5729
OP
Openmrs
Openmrs
6.1
1%
Apr 17In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS
CVE-2020-5728
OP
Openmrs
Openmrs
6.1
1%
Apr 17OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm)
CVE-2017-12795
OP
Openmrs-module-htmlformentry
Openmrs
9.8
2%
May 10OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation)
CVE-2018-19276
OP
Openmrs
Openmrs
9.8
99%
Mar 17OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via…
CVE-2018-16521
HF
Html Form Entry
Openmrs
9.8
2%
Sep 5An XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0
CVE-2017-12796
OP
Openmrs
Openmrs
9.8
4%
Oct 23The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input…
CVE-2017-7990
OM
Openmrs Module Reporting
Openmrs
8.8
1%
Apr 21The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in…
CVE-2014-8073
OP
Openmrs
Openmrs
–
1%
Oct 23Cross-site request forgery (CSRF) vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the authentication of administrators for requests that add a…
CVE-2014-8072
OP
Openmrs
Openmrs
–
2%
Oct 23The administration module in OpenMRS 2.1 Standalone Edition allows remote authenticated users to obtain read access via a direct request to /admin
CVE-2014-8071
OP
Openmrs
Openmrs
–
2%
Oct 23Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2)…