Vulnerability Description
OpenEMR is a free and open source electronic health records and medical practice management application. Versions 5.0.0.5 through 7.0.3.4 have a stored cross-site scripting vulnerability in the ub04 helper of the billing interface. The variable `$data` is passed in a click event handler enclosed in single quotes without proper sanitization. Thus, despite `json_encode` a malicious user can still inject a payload such as ` ac' ><img src=x onerror=alert(document.cookie)> ` to trigger the bug. This vulnerability allows low privileged users to embed malicious JS payloads on the server and perform stored XSS attack. This, in turn makes it possible for malicious users to steal the session cookies and perform unauthorized actions impersonating administrators. Version 7.0.4 patches the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Open-Emr | Openemr | >= 5.0.0.5, < 7.0.4 |
Related Weaknesses (CWE)
References
- https://github.com/openemr/openemr/blob/a65b11d8b8e973b8758ce0dc3efb4b6ec0466d85Patch
- https://github.com/openemr/openemr/commit/66a11c2d72ade16c4a908cd839d27cd7b261f9Patch
- https://github.com/openemr/openemr/security/advisories/GHSA-5fq8-jwvw-3m5wExploitVendor Advisory
FAQ
What is CVE-2025-67491?
CVE-2025-67491 is a vulnerability with a CVSS score of 5.4 (MEDIUM). OpenEMR is a free and open source electronic health records and medical practice management application. Versions 5.0.0.5 through 7.0.3.4 have a stored cross-site scripting vulnerability in the ub04 h...
How severe is CVE-2025-67491?
CVE-2025-67491 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-67491?
Check the references section above for vendor advisories and patch information. Affected products include: Open-Emr Openemr.