CVE-2025-29772
Published: 31 March 2025
Summary
CVE-2025-29772 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Open-Emr Openemr. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
OpenEMR, a free and open source electronic health records and medical practice management application, contains a reflected cross-site scripting vulnerability in the CAMOS new.php component. The POST parameter hidden_subcategory is written to the page without sanitization or encoding, allowing script execution under CWE-79. The issue is resolved in version 7.0.3.
An authenticated user with low privileges can supply a crafted POST request containing malicious JavaScript in the hidden_subcategory field. When another user with an active session visits the resulting link or form, the script executes in the victim's browser, enabling theft of session data or unauthorized actions within the application. The CVSS 7.2 rating reflects the need for user interaction and high attack complexity despite the network attack vector.
The official GitHub security advisory and the referenced commit in the OpenEMR repository both direct administrators to upgrade to 7.0.3 to eliminate the unsanitized output. The associated EPSS score rose from a baseline of 0.0085 to a peak of 0.0184, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8842
Vulnerability details
OpenEMR is a free and open source electronic health records and medical practice management application. The POST parameter hidden_subcategory is output to the page without being properly processed. This leads to a reflected cross-site scripting (XSS) vul;nerability in CAMOS new.php.…
more
This vulnerability is fixed in 7.0.3.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.