Librehealth Librehealth Ehr
22 CVEs affecting Librehealth Librehealth Ehr. Latest disclosed: 2022-06-09. Critical: 1, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11436 | Critical | 9.0 | 2020-07-15 | LibreHealth EMR v2.0.0 is vulnerable to XSS that results in the ability to force arbitrary actions on behalf of other users including administrators. |
CVE-2022-31496 | High | 8.8 | 2022-06-09 | LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access. |
CVE-2022-29938 | High | 8.8 | 2022-05-05 | In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\payment_master.inc.ph… |
CVE-2020-23829 | High | 8.8 | 2020-09-01 | interface/new/new_comprehensive_save.php in LibreHealth EHR 2.0.0 suffers from an authenticated file upload vulnerability, allowing remote attackers to achieve… |
CVE-2020-11439 | High | 8.8 | 2020-07-15 | LibreHealth EMR v2.0.0 is affected by a Local File Inclusion issue allowing arbitrary PHP to be included and executed within the EMR application. |
CVE-2020-11438 | High | 8.8 | 2020-07-15 | LibreHealth EMR v2.0.0 is affected by systemic CSRF. |
CVE-2018-1000839 | High | 8.8 | 2018-12-20 | LH-EHR version REL-2_0_0 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. This attack appear… |
CVE-2018-1000650 | High | 8.8 | 2018-08-20 | LibreHealthIO lh-ehr version REL-2.0.0 contains a SQL Injection vulnerability in Show Groups Popup SQL query functions that can result in Ability to perform ma… |
CVE-2018-1000649 | High | 8.8 | 2018-08-20 | LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write in letter.php (2) vulnerability in Patient file letter functions that c… |
CVE-2018-1000648 | High | 8.8 | 2018-08-20 | LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write vulnerability in Patient file letter functions that can result in Write… |
CVE-2018-1000646 | High | 8.8 | 2018-08-20 | LibreHealthIO LH-EHR version REL-2.0.0 contains an Authenticated Unrestricted File Write vulnerability in Import template that can result in write files with m… |
CVE-2018-1000647 | High | 7.1 | 2018-08-20 | LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Deletion vulnerability in Import template that can result in Denial of servic… |
CVE-2018-1000645 | Medium | 6.5 | 2018-08-20 | LibreHealthIO lh-ehr version <REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure th… |
CVE-2022-31497 | Medium | 6.1 | 2022-06-08 | LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS. |
CVE-2022-31495 | Medium | 6.1 | 2022-06-07 | LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php return_page XSS. |
CVE-2022-31494 | Medium | 6.1 | 2022-06-06 | LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php action XSS. |
CVE-2022-31498 | Medium | 6.1 | 2022-06-06 | LibreHealth EHR Base 2.0.0 allows interface/orders/patient_match_dialog.php key XSS. |
CVE-2022-31492 | Medium | 6.1 | 2022-06-06 | Cross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroup_admin_add.php Username. |
CVE-2022-31493 | Medium | 6.1 | 2022-06-06 | LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS. |
CVE-2022-29940 | Medium | 5.4 | 2022-05-05 | In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site s… |