Openemr
by Openemr
Source repositories
CVEs (229)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-2947 | Med | 0.07 | 4.8 | 0.90 | May 27, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1. | ||
| CVE-2021-25921 | Med | 0.07 | 5.4 | 0.91 | Mar 22, 2021 | In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` section. An attacker could lure an admin to enter a malicious payload and by that initiate the exploit. | ||
| CVE-2022-1179 | Med | 0.06 | 5.4 | 0.77 | Mar 30, 2022 | Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. | ||
| CVE-2021-25919 | Med | 0.06 | 4.8 | 0.70 | Mar 22, 2021 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user. | ||
| CVE-2022-1181 | Med | 0.04 | 5.4 | 0.51 | Mar 30, 2022 | Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2. | ||
| CVE-2022-1178 | Med | 0.04 | 5.4 | 0.52 | Mar 30, 2022 | Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. | ||
| CVE-2018-17179 | Cri | 0.04 | 9.8 | 0.13 | May 17, 2019 | An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php. | ||
| CVE-2012-0991 | 0.04 | — | 0.11 | Feb 7, 2012 | Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in… | |||
| CVE-2026-24849 | Cri | 0.03 | 9.9 | 0.02 | Feb 25, 2026 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method in `EtherFaxActions.php` allows authenticated users to read arbitrary files from the server filesystem. Any… | ||
| CVE-2018-9250 | Hig | 0.03 | 8.8 | 0.32 | May 18, 2018 | interface\super\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter. | ||
| CVE-2014-5462 | 0.03 | — | 0.02 | Dec 8, 2014 | Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layout_id parameter to interface/super/edit_layout.php; (2) form_patient_id, (3) form_drug_name, or (4) form_lot_number… | |||
| CVE-2013-4620 | 0.03 | — | 0.03 | Aug 9, 2013 | Cross-site scripting (XSS) vulnerability in interface/main/onotes/office_comments_full.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter. | |||
| CVE-2012-2115 | 0.03 | — | 0.02 | Sep 9, 2012 | SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter. | |||
| CVE-2011-5161 | 0.03 | — | 0.02 | Sep 9, 2012 | Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the patient… | |||
| CVE-2011-5160 | 0.03 | — | 0.01 | Sep 9, 2012 | Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter. | |||
| CVE-2012-0992 | 0.03 | — | 0.04 | Feb 7, 2012 | interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter. | |||
| CVE-2007-0649 | 0.03 | — | 0.06 | Feb 1, 2007 | Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as conduct (a) remote file inclusion attacks via the srcdir parameter in… | |||
| CVE-2006-5811 | 0.03 | — | 0.03 | Nov 8, 2006 | PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[srcdir] parameter. | |||
| CVE-2006-5795 | 0.03 | — | 0.03 | Nov 8, 2006 | Multiple PHP remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the srcdir parameter to (a) billing_process.php, (b) billing_report.php, (c)… | |||
| CVE-2006-2929 | 0.03 | — | 0.06 | Jun 9, 2006 | PHP remote file inclusion vulnerability in contrib/forms/evaluation/C_FormEvaluation.class.php in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[fileroot] parameter. |
- risk 0.07cvss 4.8epss 0.90
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.
- risk 0.07cvss 5.4epss 0.91
In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` section. An attacker could lure an admin to enter a malicious payload and by that initiate the exploit.
- risk 0.06cvss 5.4epss 0.77
Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
- risk 0.06cvss 4.8epss 0.70
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.
- risk 0.04cvss 5.4epss 0.51
Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2.
- risk 0.04cvss 5.4epss 0.52
Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
- risk 0.04cvss 9.8epss 0.13
An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php.
- CVE-2012-0991Feb 7, 2012risk 0.04cvss —epss 0.11
Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in…
- risk 0.03cvss 9.9epss 0.02
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method in `EtherFaxActions.php` allows authenticated users to read arbitrary files from the server filesystem. Any…
- risk 0.03cvss 8.8epss 0.32
interface\super\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter.
- CVE-2014-5462Dec 8, 2014risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layout_id parameter to interface/super/edit_layout.php; (2) form_patient_id, (3) form_drug_name, or (4) form_lot_number…
- CVE-2013-4620Aug 9, 2013risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in interface/main/onotes/office_comments_full.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter.
- CVE-2012-2115Sep 9, 2012risk 0.03cvss —epss 0.02
SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter.
- CVE-2011-5161Sep 9, 2012risk 0.03cvss —epss 0.02
Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the patient…
- CVE-2011-5160Sep 9, 2012risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter.
- CVE-2012-0992Feb 7, 2012risk 0.03cvss —epss 0.04
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter.
- CVE-2007-0649Feb 1, 2007risk 0.03cvss —epss 0.06
Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as conduct (a) remote file inclusion attacks via the srcdir parameter in…
- CVE-2006-5811Nov 8, 2006risk 0.03cvss —epss 0.03
PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[srcdir] parameter.
- CVE-2006-5795Nov 8, 2006risk 0.03cvss —epss 0.03
Multiple PHP remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the srcdir parameter to (a) billing_process.php, (b) billing_report.php, (c)…
- CVE-2006-2929Jun 9, 2006risk 0.03cvss —epss 0.06
PHP remote file inclusion vulnerability in contrib/forms/evaluation/C_FormEvaluation.class.php in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[fileroot] parameter.
Page 7 of 12