SB2025033017 - Multiple vulnerabilities in OpenEMR

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025033017

SB2025033017 - Multiple vulnerabilities in OpenEMR

Published: March 30, 2025 Updated: April 23, 2026

Security Bulletin ID SB2025033017
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2025-30161)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in a victim's browser and disclose sensitive information.

The vulnerability exists due to improper neutralization of script-related html tags in the bronchitis form component when rendering stored user-supplied form fields. A remote user can save a specially crafted bronchitis form value to execute arbitrary script in a victim's browser and disclose sensitive information.

User interaction is required when another user opens the form for editing and clicks on the affected field.


2) Cross-site scripting (CVE-ID: CVE-2025-30149)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in a user's browser.

The vulnerability exists due to cross-site scripting in interface\super\layout_listitems_ajax.php when handling the target parameter in requests. A remote user can send a specially crafted request to execute arbitrary script in a user's browser.

User interaction is required to trigger the issue.


3) Cross-site scripting (CVE-ID: CVE-2025-29772)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in a user's browser.

The vulnerability exists due to improper neutralization of input during web page generation in the CAMOS new.php page when handling the hidden_subcategory POST parameter. A remote user can send a specially crafted POST request to execute arbitrary script in a user's browser.

User interaction is required for exploitation.


4) Relative Path Traversal (CVE-ID: CVE-2025-29789)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to relative path traversal in the db parameter of /interface/code_systems/list_staged.php when handling requests to check the installation status of external data. A remote privileged user can send a specially crafted request to disclose sensitive information.

User interaction is required.


Remediation

Install update from vendor's website.

References