CVE-2021-25921

Name of the Vulnerable Software and Affected Versions OpenEMR versions 2.7.3-rc1 through 6.0.0

Description The issue is related to a Stored Cross-Site-Scripting (XSS) attack due to improper validation of user input in the Allergies section. An attacker could trick an administrator into entering a malicious payload, thus initiating the exploit.

Recommendations For OpenEMR versions 2.7.3-rc1 through 6.0.0, consider disabling the Allergies section until a patch is available to prevent exploitation. Restrict access to this section to minimize the risk of an attacker luring an admin into entering a malicious payload.