CVE-2026-126457

OpenEMR versions before 8.5.0 are vulnerable to a missing authorization flaw in the InstallerController module. This vulnerability allows any authenticated user, including low-privileged users like Front Office clerks, to modify module administration settings without the required admin/manage_mod...

CVE-2026-126479

OpenEMR versions before 8.5.0 are susceptible to a missing authorization vulnerability within five Module Manager InstallerController actions. The root cause is the absence of the admin/manage_modules ACL check and CSRF validation . This allows low-privilege users, such as Front Office accounts, ...

PT-2026-6381

Vulnerable Code File: packages/Ibkul/Installer/src/Routes/Ib.php groupfunction Route::controllerInstallerController::class-groupfunction Route::get'install', 'index'-name'installer.index'; Route::middlewareStartSession::class-prefix'install/api'-groupfunction Route::post'env-file-setup',...

CVE-2018-7556

LimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x before 3.4.2 mishandles application/controller/InstallerController.php after installation, which allows remote attackers to access the configuration file...

Design/Logic Flaw

LimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x before 3.4.2 mishandles application/controller/InstallerController.php after installation, which allows remote attackers to access the configuration file...