CVE-2021-43094

CRITICAL 9.8CVE-2021-43094 · Published 10/05/2022 · updated 17/06/2026

In short

CVE-2021-43094 is a CRITICAL (CVSS 9.8) vulnerability affecting openmrs (openmrs), reference application (openmrs).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
openmrs openmrs	`≤ 2.4.0`	No fix yet
reference application openmrs	`≤ 2.11`	No fix yet

Description

An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters in patient.page.

References

issues.openmrs.org/browse/TRUNK-6043 · Issue Tracking
openmrs.org/demo · Product
wiki.openmrs.org/display/docs/Reporting+Bugs · Vendor Advisory

More vulnerabilities in openmrs

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openmrs

≤ 2.4.0

No fix yet

reference application

openmrs

≤ 2.11

No fix yet

More vulnerabilities in openmrs

See all →