Skip to content
OpenAdvisories

Package · Maven

org.openmrs.api:openmrs-api

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.1
    CVE-2026-41258

    OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange

    OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates witho…

    openmrs openmrs-core org.openmrs.api:openmrs-api Maven