Open-emr Openemr
218 CVEs affecting Open-emr Openemr. Latest disclosed: 2026-06-10. Critical: 16, High: 90.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-24898 | Critical | 10.0 | 2026-03-03 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vu… |
CVE-2026-24848 | Critical | 9.9 | 2026-03-03 | OpenEMR is a free and open source electronic health records and medical practice management application. In 7.0.4 and earlier, the disposeDocument() method in… |
CVE-2026-24908 | Critical | 9.9 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability… |
CVE-2026-24849 | Critical | 9.9 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method… |
CVE-2024-22611 | Critical | 9.8 | 2025-04-03 | OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \openemr\controller.php. |
CVE-2024-37734 | Critical | 9.8 | 2024-06-26 | An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter. |
CVE-2020-13567 | Critical | 9.8 | 2022-04-18 | Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP reque… |
CVE-2019-17197 | Critical | 9.8 | 2019-10-05 | OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc. |
CVE-2019-14529 | Critical | 9.8 | 2019-08-02 | OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php. |
CVE-2018-17181 | Critical | 9.8 | 2019-05-17 | An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function… |
CVE-2018-17179 | Critical | 9.8 | 2019-05-17 | An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php… |
CVE-2018-15145 | Critical | 9.8 | 2018-08-13 | Multiple SQL injection vulnerabilities in portal/add_edit_event_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQL… |
CVE-2018-15143 | Critical | 9.8 | 2018-08-13 | Multiple SQL injection vulnerabilities in portal/find_appt_popup_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQ… |
CVE-2026-25146 | Critical | 9.6 | 2026-03-03 | OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two p… |
CVE-2026-32238 | Critical | 9.1 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection… |
CVE-2018-15152 | Critical | 9.1 | 2018-08-15 | Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (1) portal/add_edit… |
CVE-2026-33917 | High | 8.8 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais a SQL injection vuln… |
CVE-2026-32127 | High | 8.8 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, OpenEMR contains a SQL injection vul… |
CVE-2026-25746 | High | 8.8 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulner… |
CVE-2026-23627 | High | 8.8 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability… |