CVE-2025-25929
CVSS 3.1 Score 5.4 of 10 (medium)
Details
Published Mar 11, 2025
Updated: Mar 12, 2025
CWE ID 79
Summary
CVE-2025-25929 is a reflected cross-site scripting (XSS) vulnerability affecting Openmrs 2.4.3 Build 0ff0ed. This issue lies in the /legacyui/quickReportServlet component, enabling attackers to inject malicious JavaScript into the reportType parameter. Successful exploitation allows the execution of arbitrary code in the context of a user's browser, potentially leading to data theft or unauthorized system access. Users are advised to apply the relevant patch or upgrade to a secure version immediately to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.