CVE-2025-30149: OpenEMR Reflected XSS in AJAX Script
OpenEMR is a free and open source electronic health records and medical practice management application. OpenEMR allows reflected cross-site scripting (XSS) in the AJAX Script interface\super\layoutlistitemsajax.php via the target parameter. This vulnerability is fixed in 7.0.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30149?
CVE-2025-30149 is classified as a high severity vulnerability due to its potential for reflected cross-site scripting (XSS).
How do I fix CVE-2025-30149?
To fix CVE-2025-30149, upgrade your OpenEMR version to 7.0.3 or later, where the vulnerability has been addressed.
What types of attacks are possible due to CVE-2025-30149?
CVE-2025-30149 can lead to reflected cross-site scripting attacks, allowing an attacker to execute arbitrary JavaScript in the context of a victim's browser.
What software versions are affected by CVE-2025-30149?
CVE-2025-30149 affects OpenEMR versions prior to 7.0.3.
Is there a patch available for CVE-2025-30149?
Yes, a patch is available in OpenEMR version 7.0.3 to address CVE-2025-30149.