CVE-2021-25919: OpenEMR stored XSS via user creation input fields

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityRequires high privileges and victim interaction, but the stored nature and very high EPSS score raise the practical risk.

What it is

OpenEMR versions 5.0.2 through 6.0.0 fail to properly validate user input, allowing stored cross-site scripting when a highly privileged attacker creates a new user. Because the payload is persisted, it can execute in the browser of anyone who later views the affected record, making it a durable risk in a clinical application.

Impact

An attacker with high privileges can inject arbitrary script that runs in the context of other users' sessions, potentially stealing session data or performing actions as the victim. The CVSS scope change indicates the impact can extend beyond the vulnerable component.

Attack surface

The flaw is reachable over the network through the user-creation input fields, but requires high privileges and user interaction from a victim who views the injected content. No authentication bypass is involved; the attacker must already hold an elevated account.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged, but EPSS is 0.69893 (99.3rd percentile), indicating a high modeled likelihood of exploitation activity.

What to do

• Apply the vendor patch referenced in the OpenEMR commit 0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f.
• Restrict and audit accounts with privileges to create users, enforcing least privilege.
• Validate and encode all user-supplied input on user-creation forms and output contexts.
• Deploy a content security policy and output encoding to reduce stored XSS execution.
• Review existing user records for injected script content and remediate any found.

Detection

• Search application and web logs for script tags or event-handler patterns in user-creation requests.
• Monitor for anomalous user-creation activity, especially by accounts that rarely perform that action.
• Inspect stored user profile fields for HTML or JavaScript content that should not be present.
• Alert on browser-side or WAF signatures matching XSS payloads targeting OpenEMR user management endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.