CVE-2025-43860: Open-emr Openemr cross-site scripting (XSS) (CVSS 7.6)

Description

OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation and editing privileges to inject arbitrary JavaScript code into the system by entering malicious payloads in the (1) Text Box fields of Address, Address Line 2, Postal Code and City fields and (2) Drop Down menu options of Address Use, State and Country of the Additional Addresses section of the Contact tab in Patient Demographics. The injected script can execute in two scenarios: (1) dynamically during form input, and (2) when the form data is later loaded for editing. Version 7.0.3.4 contains a patch for the issue.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionRequired

ScopeChanged

ConfidentialityHigh

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Affected products

Open-emr Openemr< 7.0.3.4

Remediation

Fixed in

Open-emr Openemr≥ 7.0.3.4

Patch & vendor advisories

https://github.com/openemr/openemr/security/advisories/GHSA-2h9p-7vmc-wmqv

References

https://github.com/openemr/openemr/security/advisories/GHSA-2h9p-7vmc-wmqvExploitVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-43860 being actively exploited?

CVE-2025-43860 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 14.4%.

How severe is CVE-2025-43860?

CVE-2025-43860 has a CVSS 3.1 base score of 7.6, rated high. EPSS estimates a 14.4% probability of exploitation.

Which products are affected by CVE-2025-43860?

Affected products include Open-emr Openemr.

How do I fix CVE-2025-43860?

Upgrade affected software to a fixed version, for example Open-emr Openemr 7.0.3.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-43860 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo