CVE-2021-43094: Openmrs

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters in patient.page.

Affected products

• Openmrs Openmrs: up to and including 2.4.0
• Openmrs Reference Application: up to and including 2.11

Published 2022-05-10. Last modified 2026-06-17.