CVE-2025-67752Disclosure(open-emr / openemr)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch open-emr openemr systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper (`oeHttp`/`oeHttpRequest`) disables SSL/TLS certificate verification by default (`verify: false`), making all external HTTPS connections vulnerable to man-in-the-middle (MITM) attacks. This affects communication with government healthcare APIs and user-configurable external services, potentially exposing Protected Health Information (PHI). Version 7.0.4 fixes the issue.

open-emr CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/openemr/openemr/commit/22f8e53e5769a88b7a16cb223bd197d044c84e5a

Exploit / PoC references

https://github.com/openemr/openemr/security/advisories/GHSA-2g6h-725p-pqhp

Weakness type (CWE)

CWE-295

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openemr

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-02-25); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

open-emr

Products

openemr

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-25	2	Disclosure2
2026-03-02	1	Disclosure1

Full discourse3 posts

CVETodo@CveTodo225d
Disclosure
**CVE-2025-67752** pertains to a security flaw in **OpenEMR**, an open-source electronic health records (EHR) and practice management system. The vulnerability exists in versions prior to **7.0.4**, where the application's HTTP client wrapper (`oeHttp`/`oeHttpRequest`) disables SSL/TLS certificate verification by default (`verify: false`). This misconfiguration causes all external HTTPS connections to be insecure, making them susceptible to **Man-in-the-Middle (MITM)** attacks. #Cybersecurity #CVE #HighSeverity #SecurityAlert #RemoteCodeExecution https://cvetodo.com/cve/CVE-2025-67752
Post summary
The post announces CVE-2025-67752, a misconfiguration in OpenEMR that disables SSL/TLS certificate verification, enabling Man-in-the-Middle attacks.
0001046
20 followersView on X
CRAC Learning - Tech@cracbot220d
Disclosure
CVE-2025-67752 (CVSS:8.1, HIGH) is Analyzed. OpenEMR is a free and open source electronic health records and medical practice management application. Prior to versio..https://nvd.nist.gov/vuln/detail/CVE-2025-67752 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post references CVE‑2025‑67752 with a CVSS score of 8.1, indicating a high‑severity vulnerability in OpenEMR, but provides no further details on exploitation or mitigation.
0000042
173 followersView on X
CVE@CVEnew225d
Disclosure
CVE-2025-67752 OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper (`oeHtt… https://www.cve.org/CVERecord?id=CVE-2025-67752
Post summary
The snippet references CVE-2025-67752 affecting OpenEMR’s HTTP client wrapper before version 7.0.4, but offers no PoC, exploit, or detailed technical information.
00000139
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	open-emr	openemr	-	-	-

Explore more

Back to dashboard open-emr CVEs openemr vulnerabilities