CVE-2025-68277
February 25, 2026
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, when a link is sent via Secure Messaging, clicking the link opens the website within the OpenEMR/Portal site. This behavior could be exploited for phishing. Version 7.0.4 patches the issue.
Affected Packages
https://github.com/openemr/openemr.git (GITHUB):
Affected version(s) >=v2_7_2-rc1 <v7_0_4Fix Suggestion:
Update to version v7_0_4Related Resources (2)
Do you need more information?
Contact UsCVSS v4
Base Score:
7.2
Attack Vector
LOCAL
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
ACTIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
LOW
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
HIGH
CVSS v3
Base Score:
7.4
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
LOW
Weakness Type (CWE)
User Interface (UI) Misrepresentation of Critical Information
EPSS
Base Score:
0.01
