CVE-2025-25929: XSS

Published Mar 11, 2025

Updated

A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter.

Affected Software

2 affected components

OpenMRS Openmrs

OpenMRS Openmrs=2.4.3

Event History

Mar 11, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-25929?

CVE-2025-25929 is classified as a reflected cross-site scripting (XSS) vulnerability.

How do I fix CVE-2025-25929?

Fix CVE-2025-25929 by validating and sanitizing user input to prevent injection of malicious JavaScript payloads.

Which versions of OpenMRS are affected by CVE-2025-25929?

CVE-2025-25929 affects OpenMRS version 2.4.3 and potentially other versions if they include the vulnerable component.

What is a reflected cross-site scripting vulnerability like CVE-2025-25929?

A reflected XSS vulnerability, such as CVE-2025-25929, allows attackers to execute arbitrary JavaScript in a user's browser via crafted input.

How can attackers exploit CVE-2025-25929?

Attackers can exploit CVE-2025-25929 by injecting malicious JavaScript into the reportType parameter, which is then executed in the victim's browser.