Vulnerability · Published Feb 25, 2026 · Assigned by GitHub_M
CVE-2025-68277OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal
High 7.2
In plain English
A high-severity security flaw in openemr from openemr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 4.0)7.2High
Exploit odds (30 days)0.2%top 92.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, when a link is sent via Secure Messaging, clicking the link opens the website within the OpenEMR/Portal site. This behavior could be exploited for phishing. Version 7.0.4 patches the issue.
Affected products (as reported)
Weakness: CWE-451 · Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H