Log in Start free

OpenMRS

Products

ProductCVEsExploitedLatest
openmrs-core4–May 15, 2026
Admin UI Module3–Dec 27, 2022
Appointment Scheduling Module2–Dec 27, 2022
openmrs-module-referenceapplication2–Dec 27, 2022
HTML Form Entry UI Framework Integration Module1–Dec 27, 2022
openmrs-module-fhir21–May 29, 2025
org.openmrs.module:legacyui-api1–Sep 11, 2026

Exploited and recent CVEs

  • CVE-2026-44715 High 8.7 OpenMRS has Broken Access Control in HL7 Configuration 0.4%
  • CVE-2026-41258 Critical 9.1 OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange 0.3%
  • CVE-2026-40076 Critical 9.4 OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload 0.9%
  • CVE-2026-40075 High 8.2 OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet 0.6%
  • CVE-2025-46823 High 8.0 OpenMRS has Vulnerability in FHIR2 Module Privileges 0.4%
  • CVE-2020-36636 Low 3.5 OpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scripting 1.0%
  • CVE-2021-4292 Low 3.5 OpenMRS Admin UI Module Manage Privilege Page privilege.gsp cross site scripting 1.0%
  • CVE-2021-4291 Low 3.5 OpenMRS Admin UI Module location.gsp cross site scripting 1.0%
  • CVE-2020-36635 Low 3.5 OpenMRS Appointment Scheduling Module AppointmentTypeValidator.java validateFieldName cross site scripting 1.0%
  • CVE-2021-4289 Low 3.5 OpenMRS openmrs-module-referenceapplication User App Page UserAppPageController.java post cross site scripting 1.0%
  • CVE-2021-4288 Low 3.5 OpenMRS openmrs-module-referenceapplication userApp.gsp cross site scripting 1.0%
  • CVE-2021-4284 Low 3.5 OpenMRS HTML Form Entry UI Framework Integration Module cross site scripting 1.0%
  • CVE-2022-4727 Low 3.5 OpenMRS Appointment Scheduling Module Notes AppointmentRequest.java getNotes cross site scripting 1.0%
  • CVE-2022-23612 High 7.5 Directory Traversal in OpenMRS Startup Filter 1.9%