CVE-2025-69231 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0 contains a stored cross-site scripting vulnerability caused by improper sanitization in the GAD-7 anxiety assessment form, letting authenticated clinicians execute malicious JavaScript, leading to session hijacking and privilege escalation.

Severity & Score

Impact

Authenticated clinicians can hijack sessions, take over accounts, and escalate privileges to administrator.

Mitigation

Update to version 8.0.0 or later.

References

• https://github.com/openemr/openemr/security/advisories/GHSA-mf62-q2xc-hxm3
• https://github.com/openemr/openemr/commit/5f20b756441fc9868f43410a9ef97536c38b2ba6

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🟠 CVE-2025-69231 - High (8.7) OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a stored cross-site scripting vulnerability in the GAD-7 anxiety assessment form allows authenticated users with clini... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69231/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner