CVE-2026-63194 Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni including ERP & ELIS Atom Feed Clients. In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93...

CVE-2026-63194

The bahmnicore OpenMRS module (used in Bahmni ) is vulnerable to a path traversal flaw in version 0.93 due to insufficient validation of input paths during the admin CSV import process. This vulnerability could lead to an arbitrary file write . The issue has been patched in version 0.93.1 . No sp...

CVE-2026-63194

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni including ERP & ELIS Atom Feed Clients. In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93...

CVE-2026-63194 Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni including ERP & ELIS Atom Feed Clients. In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93...

CVE-2026-63192

The bahmnicore OpenMRS module for Bahmni (including ERP & ELIS Atom Feed Clients) is vulnerable to SQL injection in version 0.93 . An attacker with authenticated access can exploit this to exfiltrate sensitive patient data from the database using boolean blind and error-based techniques. This iss...

CVE-2026-63192 Bahmni-Core: Exfiltration of patient data stored in Bahmni through SQL injection through boolean blind and error based exfil

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni including ERP & ELIS Atom Feed Clients. In version 0.93, an attacker with authenticated access could potentially exfiltrate sensitive data from the database. This issue has been patched in version 0.93.1...

CVE-2026-15477 Bahmni bahmnicore Search Endpoint sql additionalParams sql injection

A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /openmrs/ws/rest/v1/bahmnicore/sql of the component Search Endpoint. Performing a manipulation of the argument test results in sql injection. The attack can be initiated remotely...