CVE-2025-30149

OpenEMR is a free and open source electronic health records and medical practice management application. OpenEMR allows reflected cross-site scripting (XSS) in the AJAX Script interface\super\layout_listitems_ajax.php via the target parameter. This vulnerability is fixed in 7.0.3.

CVSS v3.1

4.6 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

CVSS v3.1

6.4 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 24th percentile

Published

2025-03-31

Proof-of-concept exploits (1)

• openemr/openemr/security/advisories/GHSA-fwfv-8583-6rr7

References

• CVE Record
• NVD entry

Related

• CVE-2017-6394
• CVE-2018-1000218
• CVE-2018-1000219
• CVE-2025-29772
• CVE-2025-29789
• CVE-2025-31117