PT-2026-21821 · Openemr · Openemr

Published 2026-02-25 · Updated 2026-03-02 · CVE-2025-69231

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. A stored cross-site scripting issue exists in the GAD-7 anxiety assessment form. Authenticated users with clinician privileges can inject malicious JavaScript that executes when other users view the form. This can lead to session hijacking, account takeover, and privilege escalation from clinician to administrator. The GAD-7 anxiety assessment form is a feature used by clinicians to evaluate patient anxiety levels.

Recommendations Update to OpenEMR version 8.0.0 to fix the stored cross-site scripting issue in the GAD-7 anxiety assessment form.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-69231

GHSA-MF62-Q2XC-HXM3

Affected Products

Openemr

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69231.json · Exploit
• https://github.com/openemr/openemr/commit/5f20b756441fc9868f43410a9ef97536c38b2ba6 · Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-mf62-q2xc-hxm3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-69231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69231 · Security Note
• https://twitter.com/CveFindCom/status/2026487643769381135 · Twitter Post
• https://twitter.com/CveTodo/status/2026484826404999285 · Twitter Post
• https://twitter.com/cracbot/status/2028425177105838538 · Twitter Post
• https://twitter.com/CVEnew/status/2026641390961139835 · Twitter Post