CVE-2022-1181: OpenEMR stored cross-site scripting before 6.0.0.2

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityStored XSS in a clinical application with a high EPSS score and public exploit reference, but it requires authentication and user interaction and is not in KEV.

What it is

OpenEMR before 6.0.0.2 contains a stored cross-site scripting flaw (CWE-79) in which attacker-supplied input is persisted and later rendered to other users. Because the payload is stored, it can execute in the browsers of users who view the affected content, which matters for a clinical application handling sensitive data. The record does not name the specific vulnerable component or parameter.

Impact

An attacker can run script in the context of a victim's session, potentially stealing session data or performing actions as that user. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network (AV:N) with low attack complexity (AC:L); the attacker needs low privileges (PR:L) and a victim must interact with the crafted content (UI:R). No unauthenticated path is described in the record.

Exploitation

Not listed in CISA KEV. EPSS is high (0.51472, 98.9th percentile), and references carry an Exploit tag, but the record does not state whether exploitation has been observed in the wild.

What to do

• Upgrade OpenEMR to 6.0.0.2 or later, applying the referenced patch commit.
• If immediate upgrade is not possible, restrict access to the affected functionality to trusted authenticated users.
• Apply output encoding and input sanitization for stored user-supplied content.
• Deploy a content security policy to limit script execution in the OpenEMR web interface.

Detection

• Review OpenEMR logs for stored content containing script tags or event handler attributes.
• Monitor for anomalous authenticated sessions or requests originating from stored records.
• Search web server and application logs for injection attempts against OpenEMR input fields.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.