CVE-2021-25921: OpenEMR Allergies section stored XSS via unvalidated input

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityCVSS rates it medium (5.4) and it requires authentication plus user interaction, but the very high EPSS and stored nature in a clinical system raise the practical risk.

What it is

OpenEMR versions 2.7.3-rc1 through 6.0.0 fail to properly validate user input in the Allergies section, allowing stored cross-site scripting. Because the payload persists in the application, it can execute in the browser of any user who later views the affected record, including administrators. This matters in a clinical system where admin sessions can expose sensitive patient data and configuration.

Impact

An attacker can execute arbitrary script in a victim's authenticated session, enabling session theft, data exfiltration, or actions performed with the victim's privileges. The scope change in the CVSS vector indicates the injected script can affect resources beyond the vulnerable component.

Attack surface

Reached over the network through the Allergies section of the OpenEMR web interface. The CVSS vector requires low privileges (PR:L) and user interaction (UI:R), meaning an authenticated low-privileged user must enter the payload and an admin must be lured into viewing it.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is very high at 0.911 (99.8th percentile), but the record contains no public exploit reference, so active exploitation is not confirmed by the supplied data.

What to do

• Upgrade OpenEMR to a version containing the fix in commit 0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f or later.
• Apply output encoding and input validation to the Allergies section and any other user-supplied fields.
• Enforce a Content Security Policy that restricts inline script execution.
• Restrict who can create or edit allergy records and review existing entries for injected content.

Detection

• Search allergy record fields and audit logs for script tags, event handlers, or encoded HTML entities.
• Monitor web logs for requests containing script payloads in allergy-related parameters.
• Alert on anomalous admin session activity such as unexpected outbound requests or privilege changes after viewing allergy records.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.