CVE-2025-43860

OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation and editing privileges to inject arbitrary JavaScript code into the system by entering malicious payloads in the (1) Text Box fields of Address, Address Line 2, Postal Code and City fields and (2) Drop Down menu options of Address Use, State and Country of the Additional Addresses section of the Contact tab in Patient Demographics. The injected script can execute in two scenarios: (1) dynamically during form input, and (2) when the form data is later loaded for editing. Version 7.0.3.4 contains a patch for the issue.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/openemr/openemr/security/advisories/GHSA-2h9p-7vmc-wmqv	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*

History

02 Jul 2025, 00:36

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-23 16:15

Updated : 2025-07-02 00:36

NVD link : CVE-2025-43860

Mitre link : CVE-2025-43860

CVE.ORG link : CVE-2025-43860

JSON object : View

Products Affected

open-emr

openemr

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-43860", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.3}]}, "published": "2025-05-23T16:15:25.620", "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-2h9p-7vmc-wmqv", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation and editing privileges to inject arbitrary JavaScript code into the system by entering malicious payloads in the (1) Text Box fields of Address, Address Line 2, Postal Code and City fields and (2) Drop Down menu options of Address Use, State and Country of the Additional Addresses section of the Contact tab in Patient Demographics. The injected script can execute in two scenarios: (1) dynamically during form input, and (2) when the form data is later loaded for editing. Version 7.0.3.4 contains a patch for the issue."}, {"lang": "es", "value": "OpenEMR es una aplicaci\u00f3n gratuita y de c\u00f3digo abierto para la gesti\u00f3n de historiales m\u00e9dicos electr\u00f3nicos y consultorios m\u00e9dicos. Una vulnerabilidad de cross-site scripting (XSS) almacenado en versiones anteriores a la 7.0.3.4 permite a cualquier usuario autenticado con privilegios de creaci\u00f3n y edici\u00f3n de pacientes inyectar c\u00f3digo JavaScript arbitrario en el sistema mediante la introducci\u00f3n de payloads maliciosos en (1) los campos de texto de Direcci\u00f3n, L\u00ednea de direcci\u00f3n 2, C\u00f3digo postal y Ciudad, y (2) las opciones del men\u00fa desplegable de Uso de direcci\u00f3n, Estado y Pa\u00eds de la secci\u00f3n Direcciones adicionales de la pesta\u00f1a Contacto en Datos demogr\u00e1ficos del paciente. El script inyectado puede ejecutarse en dos escenarios: (1) din\u00e1micamente durante la entrada del formulario y (2) cuando los datos del formulario se cargan posteriormente para su edici\u00f3n. La versi\u00f3n 7.0.3.4 incluye un parche para este problema."}], "lastModified": "2025-07-02T00:36:14.620", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1D87CF1-6A62-4803-B70B-0286F6398043", "versionEndExcluding": "7.0.3.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}