CVE-2026-104136

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the newrecall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege...

CVE-2026-104137

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the smssearch branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot...

CVE-2026-104136

The OpenEMR electronic health records application is vulnerable to an improper access control issue (CWE-284) in versions prior to 8.3.0 . Specifically, the new_recall branch of interface/main/messages/save.php fails to enforce patient-level or recall-workflow authorization when processing a call...

CVE-2026-104136 OpenEMR: Arbitrary Patient Recall and Contact Detail Read

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the newrecall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege...

CVE-2026-104137 OpenEMR: Patient Data Search Without Sufficient ACL

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the smssearch branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot...

CVE-2026-104137

Prior to version 8.3.0 , OpenEMR is vulnerable to an Improper Access Control (CWE-284) issue within the sms_search branch of interface/main/messages/save.php. While the component requires an authenticated session, it fails to enforce patient or feature-level ACLs. This allows a low-privilege user...

PT-2026-110879

Name of the Vulnerable Software and Affected Versions KusalkaSilva Learning-Management-System versions up to ffeb873f8803f1e9664384ff75000c7da45466d2 Description A remote flaw exists in the getimagesize function within the upload save.php file. By manipulating the uploaded file/image argument, an...

CVE-2026-40909

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint "locale/save.php" constructs a file path by directly concatenating "$POST'flag'" into the path at line 30 without any sanitization. The "$POST'code'" parameter is then written verbatim to that path...

CVE-2026-40909: Improper Limitation of a Pathname to a Restricted Directory

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint locale/save.php constructs a file path by directly concatenating $POST'flag' into the path at line 30 without any sanitization. The $POST'code' parameter is then written verbatim to that path via...

PT-2026-35100

Summary The locale save endpoint locale/save.php constructs a file path by directly concatenating $ POST'flag' into the path at line 30 without any sanitization. The $ POST'code' parameter is then written verbatim to that path via fwrite at line 40. An admin attacker or any user who can CSRF an...

CVE-2024-25182

givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php...

CVE-2024-25182

givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php...

PT-2025-53784

Name of the Vulnerable Software and Affected Versions givanz VvvebJs version 1.7.2 Description A critical issue exists in givanz VvvebJs version 1.7.2 that permits Server-Side Request Forgery SSRF and arbitrary file reading. This is due to improper handling of user-supplied URLs within the file g...

VvvebJs security vulnerabilities

VvvebJs is a drag-and-drop website generator from Givan Personal Developers. A security vulnerability exists in VvvebJs version 1.7.2, which stems from the filegetcontents function in the save.php file mishandling user-supplied URLs, which could lead to server-side request forgery and arbitrary...

CVE-2024-25182

givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php...

CVE-2024-25182: Unrestricted Upload of File with Dangerous Type

givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php...

CVE-2024-25181

A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery SSRF and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "filegetcontents" function within the "save.php" file...

CVE-2024-25181: Server-Side Request Forgery (SSRF)

A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery SSRF and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "filegetcontents" function within the "save.php" file...

VvvebJs security vulnerabilities

VvvebJs is a drag-and-drop website generator by Givan Personal Developers. A security vulnerability exists in VvvebJs version 1.7.2, which stems from a file upload vulnerability in save.php...

CVE-2024-25181

A critical vulnerability exists in givanz VvvebJs version 1.7.2 , a drag-and-drop website generator. The flaw is caused by the improper handling of user-supplied URLs within the file_get_contents function in the save.php file. This oversight allows for Server-Side Request Forgery (SSRF) and arbit...