OpenMRS vulnerabilities

CVEs per yearBy the year they were published

1. 20229
2. 20251
3. 20264

Newest CVEs

• CVE-2026-44715

  OpenMRS has Broken Access Control in HL7 Configuration

  openmrs · org.openmrs.module:legacyui-api

  High8.7
• CVE-2026-41258

  OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange

  openmrs · openmrs-core

  Critical9.1
• CVE-2026-40076

  OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload

  openmrs · openmrs-core

  Critical9.4
• CVE-2026-40075

  OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet

  openmrs · openmrs-core

  High8.2
• CVE-2025-46823

  OpenMRS has Vulnerability in FHIR2 Module Privileges

  openmrs · openmrs-module-fhir2

  High8.0
• CVE-2020-36636

  OpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scripting

  OpenMRS · Admin UI Module

  Low3.5
• CVE-2021-4292

  OpenMRS Admin UI Module Manage Privilege Page privilege.gsp cross site scripting

  OpenMRS · Admin UI Module

  Low3.5
• CVE-2021-4291

  OpenMRS Admin UI Module location.gsp cross site scripting

  OpenMRS · Admin UI Module

  Low3.5
• CVE-2020-36635

  OpenMRS Appointment Scheduling Module AppointmentTypeValidator.java validateFieldName cross site scripting

  OpenMRS · Appointment Scheduling Module

  Low3.5
• CVE-2021-4289

  OpenMRS openmrs-module-referenceapplication User App Page UserAppPageController.java post cross site scripting

  OpenMRS · openmrs-module-referenceapplication

  Low3.5