CVE-2019-3963: OpenEMR controller.php reflected XSS in patient_id parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityCVSS rates it 6.1 medium and it requires user interaction, but high EPSS and public exploit references raise the practical risk in exposed OpenEMR deployments.

What it is

OpenEMR 5.0.1 and earlier contains a reflected cross-site scripting flaw in the patient_id parameter of controller.php. Because the parameter is reflected into the response without adequate encoding, an attacker can run script in the browser context of a logged-in user. This matters for a clinical application where session hijacking can expose patient data and allow actions as the victim.

Impact

An attacker can execute arbitrary script in a victim's session, enabling session theft, credential or data exfiltration, and actions performed with the victim's privileges. The CVSS scope change (S:C) reflects that impact can extend beyond the vulnerable component.

Attack surface

Reached over the network via a crafted URL to controller.php with a malicious patient_id value; no authentication is required to deliver the payload, but the victim must be a user who loads the link (UI:R).

Exploitation

Not listed in CISA KEV, but EPSS is high (0.52733, ~98.9th percentile) and both references are tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade OpenEMR to a version later than 5.0.1 that fixes the patient_id reflected XSS.
• If immediate upgrade is not possible, apply input validation and output encoding for the patient_id parameter in controller.php.
• Deploy a web application firewall or content security policy to block reflected script injection while patching is pending.
• Enforce HttpOnly and Secure flags on session cookies to limit session theft via injected script.

Detection

• Search web and proxy logs for requests to controller.php with patient_id values containing script tags, event handlers, or encoded payloads.
• Monitor for outbound requests or page loads referencing attacker-controlled domains from OpenEMR sessions.
• Alert on anomalous session activity or privilege changes following access to controller.php URLs with unusual patient_id parameters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.