CVE-2020-5728: Openmrs

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). There is insufficient validation for this parameter, which allows for the possibility of cross-site scripting.

Affected products

• Openmrs Openmrs: up to and including 2.9.0

Published 2020-04-17. Last modified 2026-06-17.