SB2025033017 - Multiple vulnerabilities in OpenEMR

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025033017

SB2025033017 - Multiple vulnerabilities in OpenEMR

Published: March 30, 2025 Updated: April 23, 2026

Security Bulletin ID SB2025033017
Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2025-30161)

The vulnerability allows a remote user to execute arbitrary script in a victim's browser and disclose sensitive information.

The vulnerability exists due to improper neutralization of script-related html tags in the bronchitis form component when rendering stored user-supplied form fields. A remote user can save a specially crafted bronchitis form value to execute arbitrary script in a victim's browser and disclose sensitive information.

User interaction is required when another user opens the form for editing and clicks on the affected field.


2) Cross-site scripting (CVE-ID: CVE-2025-30149)

The vulnerability allows a remote user to execute arbitrary script in a user's browser.

The vulnerability exists due to cross-site scripting in interface\super\layout_listitems_ajax.php when handling the target parameter in requests. A remote user can send a specially crafted request to execute arbitrary script in a user's browser.

User interaction is required to trigger the issue.


3) Cross-site scripting (CVE-ID: CVE-2025-29772)

The vulnerability allows a remote user to execute arbitrary script in a user's browser.

The vulnerability exists due to improper neutralization of input during web page generation in the CAMOS new.php page when handling the hidden_subcategory POST parameter. A remote user can send a specially crafted POST request to execute arbitrary script in a user's browser.

User interaction is required for exploitation.


4) Relative Path Traversal (CVE-ID: CVE-2025-29789)

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to relative path traversal in the db parameter of /interface/code_systems/list_staged.php when handling requests to check the installation status of external data. A remote privileged user can send a specially crafted request to disclose sensitive information.

User interaction is required.


Remediation

Install update from vendor's website.

References