Skip to content
OpenAdvisories

Vendor

openmrs

14 known vulnerabilities.

Products

openmrs-core 4 Admin UI Module 3 openmrs-module-referenceapplication 2 Appointment Scheduling Module 2 HTML Form Entry UI Framework Integration Module 1 openmrs-module-fhir2 1 org.openmrs.module:legacyui-api 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-41258

    OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange

    OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates witho…

    openmrs openmrs-core org.openmrs.api:openmrs-api Maven
  • Critical 9.4
    CVE-2026-40076

    OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload

    OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the module upload endpoint at POST `/openmrs/ws/rest/v1/module` is vulnerable to a Zip Slip path traversal attack. During…

    openmrs openmrs-core org.openmrs.web:openmrs-web Maven