CVE-2025-25925

MediumCVSS 4.8

Published: 11/03/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

A stored cross-site scripting (XSS) vulnerability in OpenMRS v2.4.3 Build 0ff0ed allows attackers to inject malicious JavaScript or HTML into the personName.middleName parameter at /openmrs/admin/patients/shortPatientForm.form, leading to script execution in the victim's browser.

Risk Assessment

The risk includes session hijacking, administrator account takeover, and patient data manipulation. The attack could be used to spread malware within the organization.

Recommendation

Immediately update OpenMRS to the latest patched version. Additionally, implement input validation and output encoding for all form parameters.

Original NVD description (English source)

A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the personName.middleName parameter at /openmrs/admin/patients/shortPatientForm.form.