151 matches found
CVE-2025-31117 OpenEMR Out-of-Band Server-Side Request Forgery (OOB SSRF) Vulnerability
OpenEMR is a free and open source electronic health records and medical practice management application. An Out-of-Band Server-Side Request Forgery OOB SSRF vulnerability was identified in OpenEMR, allowing an attacker to force the server to make unauthorized requests to external or internal...
CVE-2025-31117
OpenEMR — CVE-2025-31117 — is an Out-of-Band Server-Side Request Forgery (OOB SSRF) in OpenEMR that can force the server to make unauthorized requests to external or internal resources. The attack can be executed via DNS or HTTP interactions and is described as not returning a direct response, wi...
CVE-2025-30161
CVE-2025-30161 affects OpenEMR’s Bronchitis form component, where a stored XSS flaw allows an attacker who can edit a bronchitis form to steal administrator credentials. The vulnerability is documented across multiple sources and is fixed in OpenEMR release 7.0.3. The issue is rooted in the Bronc...
CVE-2025-30161 OpenEMR Stored XSS in OpenEMR Bronchitis Form
OpenEMR is a free and open source electronic health records and medical practice management application. A stored XSS vulnerability in the Bronchitis form component of OpenEMR allows anyone who is able to edit a bronchitis form to steal credentials from administrators. This vulnerability is fixed...
CVE-2025-30149 OpenEMR Reflected XSS in AJAX Script
OpenEMR is a free and open source electronic health records and medical practice management application. OpenEMR allows reflected cross-site scripting XSS in the AJAX Script interface\super\layoutlistitemsajax.php via the target parameter. This vulnerability is fixed in 7.0.3...
CVE-2025-30149 OpenEMR Reflected XSS in AJAX Script
OpenEMR is a free and open source electronic health records and medical practice management application. OpenEMR allows reflected cross-site scripting XSS in the AJAX Script interface\super\layoutlistitemsajax.php via the target parameter. This vulnerability is fixed in 7.0.3...
CVE-2025-30149
CVE-2025-30149 concerns OpenEMR, a free/open source EHR/PM app. It describes a reflected XSS in the AJAX Script interface, specifically in layout_listitems_ajax.php accessed via the target parameter. The vulnerability’s root cause is input reflected back to the user, enabling script injection. Ac...
CVE-2025-29772 OpenEMR allows Reflected XSS in CAMOS new.php
OpenEMR is a free and open source electronic health records and medical practice management application. The POST parameter hiddensubcategory is output to the page without being properly processed. This leads to a reflected cross-site scripting XSS vul;nerability in CAMOS new.php. This...
OpenEMR 安全漏洞
OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing requests. A security vulnerability exists in OpenEMR versions prior to 7.0.3, which stems...
PT-2025-13810 · Openemr · Openemr
Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 7.0.3.1 Description: An Out-of-Band Server-Side Request Forgery OOB SSRF issue was identified in OpenEMR, allowing an attacker to force the server to make unauthorized requests to external or internal resources. This...
PT-2025-13796 · Openemr · Openemr
Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 7.0.3 Description: The issue concerns reflected cross-site scripting XSS in the AJAX Script interface, specifically in the layout listitems ajax.php file via the target parameter. This allows for potential XSS attack...
CVE-2022-1178
Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4...
CVE-2022-1459
Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1...
CVE-2022-1458
Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1...
CVE-2024-0875
A stored cross-site scripting XSS vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the 'inputBody' field in the Secure Messaging feature, which can then be sent to other users. When the recipient views the malicious message, the payload is...
OpenEMR has an unspecified vulnerability (CNVD-2024-31488)
OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security vulnerability exists in OpenEMR version 7.0.2. An attacker can exploit...
CVE-2024-37734
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter...
The vulnerability of the software for managing medical organizations, OpenEMR, related to the lack of measures taken to protect the website structure, allows attackers to carry out XSS attacks.
The vulnerability of the software for managing medical organizations, OpenEMR, is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to carry out XSS attacks remotely...
The vulnerability of the software for managing medical organizations like OpenEMR, related to lack of access control, allows a intruder to disrupt the logic of the application.
The vulnerability of the software for managing medical organizations like OpenEMR is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to disrupt the logic of the application remotely...