Openemr
by Openemr
Source repositories
CVEs (217)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-4504 | 0.00 | — | 0.01 | Dec 15, 2022 | Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2. | |||
| CVE-2022-4502 | 0.00 | — | 0.01 | Dec 15, 2022 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2. | |||
| CVE-2022-4506 | 0.00 | — | 0.01 | Dec 15, 2022 | Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2. | |||
| CVE-2022-2824 | 0.00 | — | 0.01 | Aug 15, 2022 | Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1. | |||
| CVE-2022-2734 | 0.00 | — | 0.01 | Aug 9, 2022 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1. | |||
| CVE-2022-2732 | 0.00 | — | 0.01 | Aug 9, 2022 | Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1. | |||
| CVE-2022-2731 | 0.00 | — | 0.00 | Aug 9, 2022 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1. | |||
| CVE-2022-2729 | 0.00 | — | 0.00 | Aug 9, 2022 | Cross-site Scripting (XSS) - DOM in GitHub repository openemr/openemr prior to 7.0.0.1. | |||
| CVE-2022-2730 | 0.00 | — | 0.01 | Aug 9, 2022 | Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1. | |||
| CVE-2022-2494 | 0.00 | — | 0.01 | Jul 22, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0. | |||
| CVE-2022-2493 | 0.00 | — | 0.01 | Jul 22, 2022 | Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0. | |||
| CVE-2022-1461 | 0.00 | — | 0.01 | Apr 25, 2022 | Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1. | |||
| CVE-2022-1459 | 0.00 | — | 0.01 | Apr 25, 2022 | Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1. | |||
| CVE-2022-1458 | 0.00 | — | 0.01 | Apr 25, 2022 | Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1. | |||
| CVE-2020-13567 | 0.00 | — | 0.02 | Apr 18, 2022 | Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability. | |||
| CVE-2022-1180 | 0.00 | — | 0.01 | Mar 30, 2022 | Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. | |||
| CVE-2022-1177 | 0.00 | — | 0.01 | Mar 30, 2022 | Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0. | |||
| CVE-2022-24643 | 0.00 | — | 0.01 | Mar 25, 2022 | A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0. | |||
| CVE-2022-25041 | 0.00 | — | 0.01 | Mar 23, 2022 | OpenEMR v6.0.0 was discovered to contain an incorrect access control issue. | |||
| CVE-2022-25471 | 0.00 | — | 0.01 | Mar 2, 2022 | An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zend_modules/public/Installer/register. |
- CVE-2022-4504Dec 15, 2022risk 0.00cvss —epss 0.01
Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2.
- CVE-2022-4502Dec 15, 2022risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2.
- CVE-2022-4506Dec 15, 2022risk 0.00cvss —epss 0.01
Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2.
- CVE-2022-2824Aug 15, 2022risk 0.00cvss —epss 0.01
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.
- CVE-2022-2734Aug 9, 2022risk 0.00cvss —epss 0.01
Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1.
- CVE-2022-2732Aug 9, 2022risk 0.00cvss —epss 0.01
Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1.
- CVE-2022-2731Aug 9, 2022risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
- CVE-2022-2729Aug 9, 2022risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - DOM in GitHub repository openemr/openemr prior to 7.0.0.1.
- CVE-2022-2730Aug 9, 2022risk 0.00cvss —epss 0.01
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.
- CVE-2022-2494Jul 22, 2022risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.
- CVE-2022-2493Jul 22, 2022risk 0.00cvss —epss 0.01
Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.
- CVE-2022-1461Apr 25, 2022risk 0.00cvss —epss 0.01
Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1.
- CVE-2022-1459Apr 25, 2022risk 0.00cvss —epss 0.01
Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1.
- CVE-2022-1458Apr 25, 2022risk 0.00cvss —epss 0.01
Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1.
- CVE-2020-13567Apr 18, 2022risk 0.00cvss —epss 0.02
Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.
- CVE-2022-1180Mar 30, 2022risk 0.00cvss —epss 0.01
Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
- CVE-2022-1177Mar 30, 2022risk 0.00cvss —epss 0.01
Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.
- CVE-2022-24643Mar 25, 2022risk 0.00cvss —epss 0.01
A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0.
- CVE-2022-25041Mar 23, 2022risk 0.00cvss —epss 0.01
OpenEMR v6.0.0 was discovered to contain an incorrect access control issue.
- CVE-2022-25471Mar 2, 2022risk 0.00cvss —epss 0.01
An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zend_modules/public/Installer/register.
Page 9 of 11