Back to Database
Status published
High
CVE-2025-68277
OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal
Vulnerability Description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, when a link is sent via Secure Messaging, clicking the link opens the website within the OpenEMR/Portal site. This behavior could be exploited for phishing. Version 7.0.4 patches the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68277
Credits & Attribution
No credits recorded in the NVD database.
References
More from openemr
View All →CVE-2025-69231
OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation
High
8.7
CVE-2025-67752
OpenEMR Has Disabled SSL Certificate Verification in HTTP Client
High
8.1
CVE-2025-67645
OpenEMR Vulnerable to Broken Access Control in Profile Edit Endpoint
High
8.8
CVE-2025-67491
OpenEMR has Stored XSS in ub04 helper
High
8.5
CVE-2025-54373
OpenEMR may expose Contents of Clinical Notes and Care Planto users who do not have Sensitivities=high privilege
High
7.1
Affected Vendor
openemr
View all reports →Affected Software
openemr
Vulnerable Versions:
< 7.0.4
Timeline
Official Publish:
February 25th, 2026
Last Modified:
February 27th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.