CVE-2021-43094

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters in patient.page.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://issues.openmrs.org/browse/TRUNK-6043Issue Tracking, Third Party Advisory, Vendor Advisory
https://openmrs.org/demo/Product
https://wiki.openmrs.org/display/docs/Reporting+BugsVendor Advisory
https://issues.openmrs.org/browse/TRUNK-6043Issue Tracking, Third Party Advisory, Vendor Advisory
https://openmrs.org/demo/Product
https://wiki.openmrs.org/display/docs/Reporting+BugsVendor Advisory

Timeline

Published: May 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-430977.2A Server-side Template Injection (SSTI) vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute CVE-2021-430987.2A File Upload vulnerability exists in bbs v5.3 via QuestionManageAction.java in a getType function.CVE-2021-430994.9An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips t CVE-2021-43106.1A vulnerability was found in 01-Scripts 01-Artikelsystem. It has been classified as problematic. Affected is an unknown function of the file CVE-2021-431007.2A File Upload vulnerability exists in bbs 5.3 is via TopicManageAction.java in a GetType function, which lets a remote malicious user execut CVE-2021-431017.2A File Upload vulnerability exists in bbs 5.3 is via MembershipCardManageAction.java in a GetType function, which lets a remote malicious us CVE-2021-431027.2A File Upload vulnerability exists in bbs 5.3 is via HelpManageAction.java in a GetType function, which lets a remote malicious user execute CVE-2021-431037.2A File Upload vulnerability exists in bbs 5.3 is via ForumManageAction.java in a GetType function, which lets a remote malicious user execut CVE-2021-431054.3A vulnerability in the bailiwick checking function in Technitium DNS Server <= v7.0 exists that allows specific malicious users to inject `N CVE-2021-431066.1A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (TWO) 5.3.33.3 F38 and FIMI 4.2 CVE-2021-431097.5An SQL Injection vulnerability exits in PuneethReddyHC online-shopping-system as of 11/01/2021 via the p parameter in product.php.CVE-2021-43119.8A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component