Cross-site scripting in OpenEMR - CVE-2025-43860
Published: April 23, 2026
Vulnerability identifier: #VU127238
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2025-43860
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript code in another user's browser.
The vulnerability exists due to cross-site scripting in the Additional Addresses section of Patient Demographics when rendering stored address field values and dropdown option values. A remote user can enter malicious payloads into the affected fields to execute arbitrary JavaScript code in another user's browser.
User interaction is required when the affected patient record is viewed or edited, and the script may execute during form input or when the stored data is later loaded for editing.
Affected software
OpenEMR
How to mitigate CVE-2025-43860
Install security update from vendor's website.
OpenEMR - update to 7.0.3.4