Open-Emr
Page 3 of 3 — Open-Emr CVEs from a corpus of 221, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-15140 | Medium | 6.5 | 2018-08-13 | Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to read ar… |
CVE-2018-15139 | High | 8.8 | 2018-08-13 | Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbit… |
CVE-2018-9250 | High | 8.8 | 2018-05-18 | interface\super\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter. |
CVE-2018-10573 | High | 8.8 | 2018-04-30 | interface/fax/fax_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan parameter. |
CVE-2018-10572 | Medium | 6.5 | 2018-04-30 | interface/patient_file/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the newtemplatename and… |
CVE-2018-10571 | Medium | 6.1 | 2018-04-30 | Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1)… |
CVE-2018-1000020 | Medium | 6.1 | 2018-02-09 | OpenEMR version 5.0.0 contains a Cross Site Scripting (XSS) vulnerability in open-flash-chart.swf and _posteddata.php that can result in . This vulnerability a… |
CVE-2018-1000019 | High | 8.8 | 2018-02-09 | OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in fax_dispatch.php that can result in OS command injection by an authenticated attacker wi… |
CVE-2017-1000241 | High | 8.1 | 2017-11-17 | The application OpenEMR version 5.0.0, 5.0.1-dev and prior is affected by vertical privilege escalation vulnerability. This vulnerability can allow an authenti… |
CVE-2017-1000240 | Medium | 5.4 | 2017-11-17 | The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting (XSS) vulnerabilities affecting version 5.0.0 and prior versions. These… |
CVE-2017-16540 | High | 7.5 | 2017-11-04 | OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an… |
CVE-2017-12064 | High | 7.5 | 2017-08-01 | The csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a craft… |
CVE-2017-9380 | High | 8.8 | 2017-06-02 | OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vu… |
CVE-2017-6394 | Medium | 6.1 | 2017-03-02 | Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-sup… |
CVE-2015-4453 | | 2015-07-05 | interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via a… | |
CVE-2014-5462 | | 2014-12-08 | Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) la… | |
CVE-2013-4620 | | 2013-08-09 | Cross-site scripting (XSS) vulnerability in interface/main/onotes/office_comments_full.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web scr… | |
CVE-2013-4619 | | 2013-08-09 | Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) start or (2) end paramet… | |
CVE-2012-2115 | | 2012-09-09 | SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands… | |
CVE-2011-5161 | | 2012-09-09 | Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading… | |
CVE-2011-5160 | | 2012-09-09 | Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter. |