openmrs reference application vulnerabilities

Latest openmrs reference application CVEs

Newest publication first

1. CVE-2021-4289 OpenMRS openmrs-module-referenceapplication User App Page UserAppPageController.java post cross site scripting

   Published 2022-12-27

   Medium·CVSS 6.1

   A vulnerability classified as problematic was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. Affected by this vulnerability is the function post of the file omod/src/main/java/org/openmrs/module/referenceapplication/page/controller/UserAppPageController.java o...

2. CVE-2021-4288 OpenMRS openmrs-module-referenceapplication userApp.gsp cross site scripting

   Published 2022-12-27

   Medium·CVSS 6.1

   A vulnerability was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/userApp.gsp. The manipulation leads to cross site scripting. The attack may b...

3. CVE-2021-43094 An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters in patient.page.

   Published 2022-05-10

   Critical·CVSS 9.8

   An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters in patient.page.

4. CVE-2018-16521 An XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0.

   Published 2018-09-05

   Critical·CVSS 9.8

   An XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.