CVE-2025-30161: OpenEMR Stored XSS in OpenEMR Bronchitis Form
Published Mar 31, 2025
·Updated
OpenEMR is a free and open source electronic health records and medical practice management application. A stored XSS vulnerability in the Bronchitis form component of OpenEMR allows anyone who is able to edit a bronchitis form to steal credentials from administrators. This vulnerability is fixed in 7.0.3.
Affected Software
2 affected components
OpenEMR OpenEMR<7.0.3
open-emr Openemr<7.0.3
Event History
Mar 31, 2025
CVE Published
via MITRE·04:12 PM
Data Sourced
via MITRE·04:12 PM
DescriptionWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-30161?
CVE-2025-30161 is classified as a high severity stored XSS vulnerability.
2
How do I fix CVE-2025-30161?
To fix CVE-2025-30161, upgrade OpenEMR to version 7.0.4 or later.
3
Who is affected by CVE-2025-30161?
CVE-2025-30161 affects users of OpenEMR versions prior to 7.0.4.
4
What is the main impact of CVE-2025-30161?
The main impact of CVE-2025-30161 is the potential for credential theft from administrators.
5
What component of OpenEMR is vulnerable in CVE-2025-30161?
The Bronchitis form component of OpenEMR is vulnerable in CVE-2025-30161.