Open-Emr
Page 2 of 3 — Open-Emr CVEs from a corpus of 221, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2943 | High | 8.8 | 2023-05-27 | Code Injection in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2942 | High | 8.1 | 2023-05-27 | Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2674 | Medium | 4.3 | 2023-05-12 | Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2566 | Medium | 4.8 | 2023-05-08 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-22974 | High | 7.5 | 2023-02-22 | A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-control… |
CVE-2023-22973 | High | 8.8 | 2023-02-22 | A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname… |
CVE-2023-22972 | Medium | 5.4 | 2023-02-22 | A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote authenticated users… |
CVE-2022-4733 | Medium | 4.8 | 2022-12-27 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4615 | Medium | 6.1 | 2022-12-19 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4567 | High | 8.1 | 2022-12-17 | Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4506 | High | 8.8 | 2022-12-15 | Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4505 | High | 8.8 | 2022-12-15 | Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4504 | High | 7.5 | 2022-12-15 | Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4503 | Medium | 6.1 | 2022-12-15 | Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4502 | Medium | 6.1 | 2022-12-15 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-2824 | High | 8.8 | 2022-08-15 | Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1. |
CVE-2022-2734 | Medium | 5.4 | 2022-08-09 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1. |
CVE-2022-2733 | Medium | 6.1 | 2022-08-09 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1. |
CVE-2022-2732 | High | 8.3 | 2022-08-09 | Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1. |
CVE-2022-2731 | Medium | 6.1 | 2022-08-09 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1. |
CVE-2022-2730 | Medium | 6.5 | 2022-08-09 | Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1. |
CVE-2022-2729 | Medium | 5.4 | 2022-08-09 | Cross-site Scripting (XSS) - DOM in GitHub repository openemr/openemr prior to 7.0.0.1. |
CVE-2022-2494 | Medium | 5.4 | 2022-07-22 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0. |
CVE-2022-2493 | High | 8.1 | 2022-07-22 | Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0. |
CVE-2022-1461 | Medium | 6.5 | 2022-04-25 | Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1. |
CVE-2022-1459 | High | 8.3 | 2022-04-25 | Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1. |
CVE-2022-1458 | Medium | 5.4 | 2022-04-25 | Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1. |
CVE-2020-13567 | Critical | 9.8 | 2022-04-18 | Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP reque… |
CVE-2022-1181 | Medium | 5.4 | 2022-03-30 | Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2. |
CVE-2022-1180 | Low | 3.5 | 2022-03-30 | Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. |
CVE-2022-1179 | Medium | 5.4 | 2022-03-30 | Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. |
CVE-2022-1178 | Medium | 5.4 | 2022-03-30 | Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. |
CVE-2022-1177 | Medium | 4.3 | 2022-03-30 | Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0. |
CVE-2022-24643 | Medium | 5.4 | 2022-03-25 | A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0. |
CVE-2022-25041 | Medium | 4.3 | 2022-03-23 | OpenEMR v6.0.0 was discovered to contain an incorrect access control issue. |
CVE-2022-25471 | High | 8.1 | 2022-03-03 | An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a craft… |
CVE-2021-41843 | Medium | 6.5 | 2021-12-17 | An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the dat… |
CVE-2021-40352 | Medium | 6.5 | 2021-09-01 | OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users. |
CVE-2021-25923 | High | 8.1 | 2021-06-24 | In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user… |
CVE-2021-32104 | High | 8.8 | 2021-05-07 | A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1. |
CVE-2021-32103 | Medium | 4.8 | 2021-05-07 | A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web scrip… |
CVE-2021-32102 | High | 8.8 | 2021-05-07 | A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1. |
CVE-2021-32101 | High | 8.2 | 2021-05-07 | The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability, an… |
CVE-2020-13568 | High | 8.8 | 2021-04-13 | SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trig… |
CVE-2020-13566 | High | 8.8 | 2021-04-13 | SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to tri… |
CVE-2021-25922 | Medium | 6.1 | 2021-03-22 | In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly. An attacker could tr… |
CVE-2021-25921 | Medium | 5.4 | 2021-03-22 | In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` s… |
CVE-2021-25920 | Medium | 6.5 | 2021-03-22 | In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user able to read and s… |
CVE-2021-25919 | Medium | 4.8 | 2021-03-22 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A highly privileged att… |
CVE-2021-25918 | Medium | 4.8 | 2021-03-22 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the TOTP… |
CVE-2021-25917 | Medium | 4.8 | 2021-03-22 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the U2F… |
CVE-2020-29143 | High | 7.2 | 2021-02-15 | A SQL injection vulnerability in interface/reports/non_reported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL c… |
CVE-2020-29140 | High | 7.2 | 2021-02-15 | A SQL injection vulnerability in interface/reports/immunization_report.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrar… |
CVE-2020-29139 | High | 7.2 | 2021-02-15 | A SQL injection vulnerability in interface/main/finder/patient_select.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote authenticated atta… |
CVE-2020-29142 | High | 7.2 | 2021-02-15 | A SQL injection vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary… |
CVE-2020-13565 | Medium | 6.1 | 2021-02-10 | An open redirect vulnerability exists in the return_page redirection functionality of phpGACL 3.3.7, OpenEMR 5.0.2 and OpenEMR development version 6.0.0 (commi… |
CVE-2020-36243 | High | 8.8 | 2021-02-07 | The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php. To exploit the vulnerability, an authenti… |
CVE-2020-13564 | Medium | 6.1 | 2021-02-01 | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript e… |
CVE-2020-13563 | Medium | 6.1 | 2021-02-01 | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript e… |
CVE-2020-13562 | Medium | 6.1 | 2021-02-01 | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript e… |
CVE-2020-13569 | High | 8.8 | 2021-01-28 | A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 (commit babec93f600ff1394f91ccd512bc… |
CVE-2020-19364 | High | 8.8 | 2021-01-20 | OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php. |
CVE-2018-16795 | High | 8.8 | 2020-12-31 | OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manage_site_files.php… |
CVE-2019-16404 | High | 8.8 | 2019-10-21 | Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr databa… |
CVE-2019-17409 | Medium | 6.1 | 2019-10-21 | Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter. |
CVE-2019-16862 | Medium | 6.1 | 2019-10-21 | Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's s… |
CVE-2019-17197 | Critical | 9.8 | 2019-10-05 | OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc. |
CVE-2019-17179 | Medium | 6.1 | 2019-10-04 | 4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0… |
CVE-2019-8368 | Medium | 6.1 | 2019-09-16 | OpenEMR v5.0.1-6 allows XSS. |
CVE-2019-8371 | High | 7.2 | 2019-09-16 | OpenEMR v5.0.1-6 allows code execution. |
CVE-2019-3968 | High | 8.8 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new f… |
CVE-2019-3967 | Medium | 6.5 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary… |
CVE-2019-3966 | Medium | 6.1 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitr… |
CVE-2019-3965 | Medium | 6.1 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbit… |
CVE-2019-3964 | Medium | 6.1 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary… |
CVE-2019-3963 | Medium | 6.1 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitr… |
CVE-2019-14530 | High | 8.8 | 2019-08-13 | An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by… |
CVE-2019-14529 | Critical | 9.8 | 2019-08-02 | OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php. |
CVE-2018-17181 | Critical | 9.8 | 2019-05-17 | An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function… |
CVE-2018-17180 | Medium | 5.3 | 2019-05-17 | An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/download_template.php. |
CVE-2018-17179 | Critical | 9.8 | 2019-05-17 | An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php… |
CVE-2018-18035 | Medium | 6.1 | 2019-04-02 | A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) atta… |
CVE-2018-1000219 | Medium | 5.4 | 2018-08-20 | OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'scan' parameter in line #41 of interface/fax/fax_view.php that can result… |
CVE-2018-1000218 | Medium | 5.4 | 2018-08-20 | OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of interface/fax/fax_view.php that can result… |
CVE-2018-15156 | High | 8.8 | 2018-08-15 | OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted r… |
CVE-2018-15155 | High | 8.8 | 2018-08-15 | OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted r… |
CVE-2018-15154 | High | 8.8 | 2018-08-15 | OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted r… |
CVE-2018-15153 | High | 8.8 | 2018-08-15 | OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted r… |
CVE-2018-15152 | Critical | 9.1 | 2018-08-15 | Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (1) portal/add_edit… |
CVE-2018-15151 | High | 8.8 | 2018-08-15 | SQL injection vulnerability in interface/de_identification_forms/find_code_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attack… |
CVE-2018-15150 | High | 8.8 | 2018-08-15 | SQL injection vulnerability in interface/de_identification_forms/de_identification_screen2.php in versions of OpenEMR before 5.0.1.4 allows a remote authentica… |
CVE-2018-15149 | High | 8.8 | 2018-08-15 | SQL injection vulnerability in interface/forms/eye_mag/php/Anything_simple.php from library/forms.inc in versions of OpenEMR before 5.0.1.4 allows a remote aut… |
CVE-2018-15148 | High | 8.8 | 2018-08-15 | SQL injection vulnerability in interface/patient_file/encounter/search_code.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to… |
CVE-2018-15147 | High | 8.8 | 2018-08-15 | SQL injection vulnerability in interface/forms_admin/forms_admin.php from library/registry.inc in versions of OpenEMR before 5.0.1.4 allows a remote authentica… |
CVE-2018-15146 | High | 8.8 | 2018-08-15 | SQL injection vulnerability in interface/de_identification_forms/find_immunization_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticate… |
CVE-2018-15145 | Critical | 9.8 | 2018-08-13 | Multiple SQL injection vulnerabilities in portal/add_edit_event_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQL… |
CVE-2018-15144 | High | 8.8 | 2018-08-13 | SQL injection vulnerability in interface/de_identification_forms/find_drug_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attack… |
CVE-2018-15143 | Critical | 9.8 | 2018-08-13 | Multiple SQL injection vulnerabilities in portal/find_appt_popup_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQ… |
CVE-2018-15142 | High | 8.8 | 2018-08-13 | Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to execute… |
CVE-2018-15141 | Medium | 6.5 | 2018-08-13 | Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to delete… |