CVE-2019-3964: OpenEMR controller.php doc_id reflected XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityPublic exploit references and a very high EPSS percentile raise the likelihood of attempted exploitation despite the medium CVSS score.

What it is

OpenEMR 5.0.1 and earlier contains a reflected cross-site scripting flaw in the doc_id parameter of controller.php. Because the injected script runs in the victim's session context, it can be used to act as the logged-in user. The record gives no further detail on the exact request path or output encoding failure.

Impact

An attacker can execute arbitrary script in a victim's browser session, potentially stealing session data or performing actions as that user. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network via a crafted request to controller.php with a malicious doc_id value; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so a victim must be induced to load the crafted link.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.53 (98.9th percentile) and the only references are tagged Exploit, indicating public exploit detail exists.

What to do

• Upgrade OpenEMR past 5.0.1 to a release that fixes the doc_id reflected XSS.
• If immediate upgrade is not possible, apply vendor or community patches for controller.php and validate output encoding of doc_id.
• Deploy a WAF rule or input filtering that blocks script payloads in the doc_id parameter.
• Restrict exposure of the OpenEMR instance and enforce strong session protections such as HttpOnly and short session lifetimes.

Detection

• Search web and proxy logs for requests to controller.php with script-like content in the doc_id parameter.
• Alert on reflected payloads containing script tags, event handlers or javascript: URIs in doc_id values.
• Monitor for anomalous authenticated actions or session token use following requests with suspicious doc_id values.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.