CVE-2023-2566 Cross-site Scripting (XSS) - Stored in openemr/openemr

Cross-site Scripting XSS - Stored in GitHub repository openemr/openemr prior to 7.0.1...

OpenEMR 7.0.1 Authentication Bruteforce Mitigation Bypass

Exploit Title: OpenEMR v7.0.1 - Authentication credentials brute force Date: 2023-04-28 Exploit Author: abhhi Abhishek Birdawade Vendor Homepage: https://www.open-emr.org/ Software Link: https://github.com/openemr/openemr/archive/refs/tags/v701.tar.gz Version: 7.0.1 Tested on: Windows ''' Example...

OpenEMR v7.0.1 - Authentication credentials brute force

Exploit Title: OpenEMR v7.0.1 - Authentication credentials brute force Date: 2023-04-28 Exploit Author: abhhi Abhishek Birdawade Vendor Homepage: https://www.open-emr.org/ Software Link: https://github.com/openemr/openemr/archive/refs/tags/v701.tar.gz Version: 7.0.1 Tested on: Windows ''' Example...

OpenEMR v7.0.1 - Authentication credentials brute force Exploit

Exploit Title: OpenEMR v7.0.1 - Authentication credentials brute force Date: 2023-04-28 Exploit Author: abhhi Abhishek Birdawade Vendor Homepage: https://www.open-emr.org/ Software Link: https://github.com/openemr/openemr/archive/refs/tags/v701.tar.gz Version: 7.0.1 Tested on: Windows ''' Example...

Stored XSS in Admin Panel

Description The admin panel admin.php does not properly sanitize the text in the "Site Name" field, allowing a user with admin access to inject arbitrary HTML. This is in a similar vein to CVE-2022-4733 but still exists as of version 7.0.1-dev. Proof of Concept 1. Log in as a user with admin...

The vulnerability in the setup.php script of the software installer for managing medical organizations like OpenEMR allows a malicious individual to gain unauthorized access to protected information.

The vulnerability in the setup.php script of the software for managing medical organizations like OpenEMR relates to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Access Control Vulnerability in Admin Address Book

Description An Access Control Vulnerability allows a low level user in the web application to view and edit information for all other users in the Admin Address Book. Proof of Concept Step 1. Login to the openemr web application as a low level user Ex: Receptionist in openemr demo \ Step 2. Trave...

OpenEMR Local File Containment Vulnerability (CNVD-2023-40914)

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A local file inclusion vulnerability exists in versions of OpenEMR prior to 7.0.0,...

CVE-2023-22972

A Reflected Cross-site scripting XSS vulnerability in interface/forms/eyemag/php/eyemagfunctions.php in OpenEMR 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUESTURI...

CVE-2023-22973

A Local File Inclusion LFI vulnerability in interface/forms/LBF/new.php in OpenEMR 7.0.0 allows remote authenticated users to execute code via the formname parameter...

CVE-2023-22974

A Path Traversal in setup.php in OpenEMR 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server...

Path traversal

A Path Traversal in setup.php in OpenEMR 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server...

Cross site scripting

A Reflected Cross-site scripting XSS vulnerability in interface/forms/eyemag/php/eyemagfunctions.php in OpenEMR 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUESTURI...

Remote file inclusion

A Local File Inclusion LFI vulnerability in interface/forms/LBF/new.php in OpenEMR 7.0.0 allows remote authenticated users to execute code via the formname parameter...

OpenEMR 跨站脚本漏洞

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security vulnerability exists in OpenEMR version 7.0.0, which stems from the...

PT-2023-18806 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 7.0.0 Description: A Reflected Cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via the REQUEST URI. This affects the eye mag functions.php file in the...

CVE-2023-22972

A Reflected Cross-site scripting XSS vulnerability in interface/forms/eyemag/php/eyemagfunctions.php in OpenEMR 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUESTURI...

CVE-2023-22973

A Local File Inclusion LFI vulnerability in interface/forms/LBF/new.php in OpenEMR 7.0.0 allows remote authenticated users to execute code via the formname parameter...

CVE-2023-22974

CVE-2023-22974 describes a path traversal in OpenEMR’s setup.php affecting versions earlier than 7.0.0. An unauthenticated remote attacker can read arbitrary files by manipulating a connection to an attacker-controlled MySQL server, due to the underlying directory-path handling in setup.php. Repo...

CVE-2023-22974

A Path Traversal in setup.php in OpenEMR 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server...