Back to Database
Status published
High
CVE-2025-30161
OpenEMR Stored XSS in OpenEMR Bronchitis Form
Vulnerability Description
OpenEMR is a free and open source electronic health records and medical practice management application. A stored XSS vulnerability in the Bronchitis form component of OpenEMR allows anyone who is able to edit a bronchitis form to steal credentials from administrators. This vulnerability is fixed in 7.0.3.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-30161
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/openemr/openemr/security/advisories/GHSA-59rv-645x-rg6p
- https://github.com/openemr/openemr/blob/17ca5539bafcdc25a9042ebc14480552e07867e4/interface/forms/bronchitis/view.php#L102-L103
- https://github.com/openemr/openemr/blob/17ca5539bafcdc25a9042ebc14480552e07867e4/interface/forms/bronchitis/view.php#L303-L304
More from openemr
View All →CVE-2025-69231
OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation
High
8.7
CVE-2025-68277
OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal
High
7.2
CVE-2025-67752
OpenEMR Has Disabled SSL Certificate Verification in HTTP Client
High
8.1
CVE-2025-67645
OpenEMR Vulnerable to Broken Access Control in Profile Edit Endpoint
High
8.8
CVE-2025-67491
OpenEMR has Stored XSS in ub04 helper
High
8.5
Affected Vendor
openemr
View all reports →Affected Software
openemr
Vulnerable Versions:
< 7.0.3
Timeline
Official Publish:
March 31st, 2025
Last Modified:
March 31st, 2025
Added to House:
July 22nd, 2026