151 matches found
CVE-2021-25919
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user...
OpenEMR SQL Injection Vulnerability (CNVD-2021-12108)
OpenEMR is a medical practice management software that also supports electronic medical records EMR. A SQL injection vulnerability exists in interface/main/finder/patientselect.php in OpenEMR versions prior to 5.0.2.5. A remote authenticated attacker can exploit this vulnerability to execute...
CVE-2020-29142
A SQL injection vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedulefacility parameter when restrictuserfacility=on is in global settings...
Cross site request forgery (csrf)
A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 commit babec93f600ff1394f91ccd512bcad85832eb6ce. A specially crafted HTTP request can lead to the execution of arbitrary requests in the context of the victim. An attacker ca...
PT-2021-9642 · Openemr · Openemr
Name of the Vulnerable Software and Affected Versions: OpenEMR versions 5.0.2 through 6.0.0 Description: A cross-site request forgery issue exists in the GACL functionality. This allows an attacker to send a specially crafted HTTP request, leading to the execution of arbitrary requests in the...
CVE-2018-16795
OpenEMR 5.0.1.3 is vulnerable to Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, demonstrated by uploading a PHP file through interface/super/manage_site_files.php. The flaw enables unauthorized state-changing actions and potential code execution via the uploaded PHP file....
PT-2019-13736 · Openemr · Openemr
Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.2 Description: The issue allows SQL Injection in the interface/forms/eye mag/save.php file. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents...
CVE-2018-17180
An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/downloadtemplate.php...
Design/Logic Flaw
interface/fax/faxdispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan parameter...
CVE-2018-1000019
OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in faxdispatch.php that can result in OS command injection by an authenticated attacker with any role. This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher...
