CVE-2020-5728

PoC —

CVSS 3.1

6.1 medium

EPSS

1%p65

Published

Apr 17, 2020 (Apr 17, 2020)

Modified

Jun 17, 2026

Description

OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). There is insufficient validation for this parameter, which allows for the possibility of cross-site scripting.

Vendors: openmrs
Products: openmrs
Weakness: CWE-20, CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news0 stories

No ingested article mentions this CVE yet.