CVE-2021-4291

A vulnerability was found in OpenMRS Admin UI Module up to 1.5.x. It has been declared as problematic. This vulnerability affects unknown code of the file omod/src/main/webapp/pages/metadata/locations/location.gsp. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.6.0 is able to address this issue. The name of the patch is a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216916.

• CWE-79

• https://github.com/openmrs/openmrs-module-adminui/commit/a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6Patch, Third Party Advisory
• https://github.com/openmrs/openmrs-module-adminui/pull/61Patch, Third Party Advisory
• https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.6.0Release Notes, Third Party Advisory
• https://vuldb.com/?ctiid.216916Permissions Required, Third Party Advisory
• https://vuldb.com/?id.216916Permissions Required, Third Party Advisory
• https://github.com/openmrs/openmrs-module-adminui/commit/a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6Patch, Third Party Advisory
• https://github.com/openmrs/openmrs-module-adminui/pull/61Patch, Third Party Advisory
• https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.6.0Release Notes, Third Party Advisory
• https://vuldb.com/?ctiid.216916Permissions Required, Third Party Advisory
• https://vuldb.com/?id.216916Permissions Required, Third Party Advisory

Published

Dec 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42890TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command inj…9.8
• CVE-2021-42891In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain se…7.5
• CVE-2021-42892In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can start tel…4.3
• CVE-2021-42893In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain se…7.5
• CVE-2021-42897A remote command execution (RCE) vulnerability was found in …9.8
• CVE-2021-4290A vulnerability was found in DHBW Fallstudie. It has been de…9.8
• CVE-2021-42911A Format String vulnerability exists in DrayTek Vigor 2960 <…9.8
• CVE-2021-42912FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS c…8.8
• CVE-2021-42913The SyncThru Web Service on Samsung SCX-6x55X printers allow…7.5
• CVE-2021-42917Buffer overflow vulnerability in Kodi xbmc up to 19.0, allow…5.5
• CVE-2021-4292A vulnerability was found in OpenMRS Admin UI Module up to 1…6.1
• CVE-2021-42923ShowMyPC 3606 on Windows suffers from a DLL hijack vulnerabi…7.3