OpenMRS is a widely adopted open-source electronic health record platform deployed across resource-constrained healthcare settings and research institutions, where its modular architecture and extensibility underpin clinical workflows across many jurisdictions. Despite a narrow product footprint, the vendor commands prominence in the medical-software landscape and faces a persistent exposure pattern: its vulnerabilities skew toward serious outcomes, with a meaningful share reaching critical severity, and they recur across the core platform and modules such as the reference application, admin UI, and appointment scheduling through web-tier weakness classes including cross-site scripting, CSRF, path traversal, untrusted deserialization, and improper input validation. These defect classes reflect the challenges of building web-facing healthcare software that integrates with legacy systems and third-party modules while maintaining broad compatibility. Defenders operating OpenMRS instances should prioritize vulnerability tracking and timely patching, particularly where instances face internet exposure or handle sensitive patient data; current severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Openmrs over time
Signals from CVEs in this vendor scope (31 CVEs).
31 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-19276CRITICAL OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via c | Mar 21, 2019 | 9.8 | 94 | NO | YES |
CVE-2026-40076HIGH OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the module upload endpoint at POST `/openm | May 6, 2026 | 8.8 | 34 | NO | NO |
CVE-2017-12795CRITICAL OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation). | May 10, 2019 | 9.8 | 32 | NO | NO |
CVE-2026-40075HIGH OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the `/openmrs/moduleResources/{moduleid}` | May 5, 2026 | 7.5 | 30 | NO | NO |
CVE-2018-16521CRITICAL An XML External Entity (XXE) vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0. | Sep 5, 2018 | 9.8 | 30 | NO | NO |
CVE-2017-12796CRITICAL The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input | Oct 23, 2017 | 9.8 | 30 | NO | NO |
CVE-2021-43094CRITICAL An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters in | May 10, 2022 | 9.8 | 29 | NO | NO |
CVE-2017-7990HIGH The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/ | Apr 21, 2017 | 8.8 | 28 | NO | NO |
CVE-2022-23612HIGH OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subject to arbitrary file | Feb 22, 2022 | 7.5 | 26 | NO | NO |
CVE-2020-24621HIGH A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Ve | Sep 25, 2020 | 8.8 | 26 | NO | NO |
Signals from CVEs in this vendor scope (31 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Openmrs.
Media articles that mention a CVE ID that affects a product developed by Openmrs — matched by CVE ID, not by vendor name.