CVE-2023-22974

A Path Traversal in setup.php in OpenEMR 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server...

OpenEMR Access Control Error Vulnerability (CNVD-2023-40915)

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. An Access Control Error vulnerability exists in versions of OpenEMR prior to...

PT-2022-27395 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: openemr versions prior to 7.0.0.2 Description: The issue concerns an unrestricted upload of a file with a dangerous type in the GitHub repository openemr/openemr. Recommendations: For versions prior to 7.0.0.2, update to version 7.0.0.2 or...

CVE-2022-4506 Unrestricted Upload of File with Dangerous Type in openemr/openemr

Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2...

CVE-2022-4502 Cross-site Scripting (XSS) - Reflected in openemr/openemr

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2...

CVE-2022-4505 Authorization Bypass Through User-Controlled Key in openemr/openemr

Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.2...

PT-2022-18902 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: openemr versions prior to 7.0.0.1 Description: The issue is related to improper access control, specifically an authorization bypass through a user-controlled key. This allows unauthorized access to certain resources. Recommendations: For...

CVE-2022-2732

Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1...

CVE-2022-25041

OpenEMR v6.0.0 was discovered to contain an incorrect access control issue...

The vulnerability of the portal/patient/_machine_config.php component of the software for managing medical organizations OpenEMR allows a intruder to gain unauthorized access to protected information.

The vulnerability of the portal/patient/machineconfig.php component of the software for managing medical organizations OpenEMR is related to insufficient checking of permission assignment for critical resources. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gai...

OpenEMR 安全漏洞

OpenEMR is an open source medical management system from the OpenEMR Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing requests. A security vulnerability exists in OpenEMR versions 5.0.0 through 6.0.0.1...

OpenEMR 5.0.1.3 - (manage_site_files) Remote Code Execution Exploit

Exploit Title: OpenEMR 5.0.1.3 - 'managesitefiles' Remote Code Execution Authenticated Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://www.open-emr.org/ Software Link: https://github.com/openemr/openemr/archive/refs/tags/v5013.zip Version: Prior to 5.0.1.4 Tested on: Ubuntu 18.04...

OpenEMR Access Control Error Vulnerability

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. An access control error vulnerability exists in OpenEMR version 5.0.2.1, which ste...

OpenEMR SQL Injection Vulnerability (CNVD-2021-35246)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A SQL injection vulnerability exists in interface/forms/eyemag/save.php in OpenEMR version 5.0.2.1. No details of the vulnerability are provided at this time...

OpenEMR Cross-Site Scripting Vulnerability (CNVD-2021-35245)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A stored cross-site scripting vulnerability exists in interface/usergroup/usergroupadmin.php in OpenEMR versions prior to 5.0.2.1. An attacker can exploit this vulnerability to inject arbitrary we...

OpenEMR SQL Injection Vulnerability (CNVD-2021-35244)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A SQL injection vulnerability exists in library/customtemplate/ajaxcode.php in OpenEMR version 5.0.2.1. No detailed vulnerability details are provided at this time...

CVE-2021-32103

A Stored XSS vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter...

OpenEMR Cross-Site Scripting Vulnerability

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A stored cross-site scripting vulnerability exists in OpenEMR versions 5.0.2 - 6.0.0. The vulnerability stems from not properly validating user input. An attacker can exploit the vulnerability to...

CVE-2021-25917

In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly and rendered in the U2F USB Device authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...

CVE-2021-25918

In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...