CVE-2025-69231: OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a stored cross-site scripting vulnerability in the GAD-7 anxiety assessment form allows authenticated users with clinician privileges to inject malicious JavaScript that executes when other users view the form. This enables session hijacking, account takeover, and privilege escalation from clinician to administrator. Version 8.0.0 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69231?
CVE-2025-69231 is assessed to have a high severity due to the potential for session hijacking and privilege escalation.
How do I fix CVE-2025-69231?
To fix CVE-2025-69231, upgrade OpenEMR to version 8.0.0 or later.
What types of vulnerabilities are associated with CVE-2025-69231?
CVE-2025-69231 is associated with stored cross-site scripting (XSS) vulnerabilities.
Who is affected by CVE-2025-69231?
Any users of OpenEMR versions prior to 8.0.0 are affected by CVE-2025-69231.
What can attackers do with CVE-2025-69231?
Attackers can exploit CVE-2025-69231 to hijack user sessions and escalate their privileges.