OpenEMR < 6.1.0.1 Multiple Vulnerabilities

OpenEMR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr"; ifdescription...

Cross site script

Description In this case a patient is able to execute js scripts in admin's session. further exploitation could lead to admin account takeover Steps to Repro:- 1. Login here https://demo.openemr.io/openemr/portal 2. Goto my documents and create new insurance form 3. Add this payload to any select...

CVE-2022-2493

Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0...

CVE-2022-2493

Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0...

CVE-2022-2494

Cross-site Scripting XSS - Stored in GitHub repository openemr/openemr prior to 7.0.0...

CVE-2022-2494

Cross-site Scripting XSS - Stored in GitHub repository openemr/openemr prior to 7.0.0...

Cross site scripting

Cross-site Scripting XSS - Stored in GitHub repository openemr/openemr prior to 7.0.0...

CVE-2022-2494 Cross-site Scripting (XSS) - Stored in openemr/openemr

Cross-site Scripting XSS - Stored in GitHub repository openemr/openemr prior to 7.0.0...

CVE-2022-2494 Cross-site Scripting (XSS) - Stored in openemr/openemr

Cross-site Scripting XSS - Stored in GitHub repository openemr/openemr prior to 7.0.0...

CVE-2022-2494

CVE-2022-2494 is a Cross-site Scripting (XSS) vulnerability stored in OpenEMR repositories prior to version 7.0.0. Multiple connected sources consistently describe the issue as arising from failure to encode key/value data in patientdate.js, enabling attackers to execute JavaScript in a victim’s ...

EUVD-2022-34753

Cross-site Scripting XSS - Stored in GitHub repository openemr/openemr prior to 7.0.0...

CVE-2022-2493

CVE-2022-2493 affects OpenEMR prior to 7.0.0, where a missing functional-level access control allows non-privileged users to access administrator modules, enabling data access outside the expected Data Manager boundary. Reports and CVSS data confirm a HIGH-severity impact with confidentiality and...

CVE-2022-2493 Data Access from Outside Expected Data Manager Component in openemr/openemr

Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0...

DOM-based Cross-Site Scripting (XSS) in OpenEMR 7.0.0 and below at White list files

Description We would like to report the vulnerability we found during software testing. The OpenEMR 7.0.0 latest version and below version; Open Source electronic health records and medical practice management application; has DOM-based Cross-Site Scripting XSS vulnerability in the...

OpenEMR 跨站脚本漏洞

OpenEMR is an open source healthcare management system from the Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing applications. openemr versions prior to 7.0.0 have a cross-site scripting vulnerability...

OpenEMR 安全漏洞

OpenEMR is an open source healthcare management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing applications. versions of OpenEMR prior to 7.0.0 have an access control error...

Non-Privilege user can view Patient's Amendments

Description We would like to report the vulnerability we found during software testing. The OpenEMR 7.0.0 latest version Open-Source electronic health records and medical practice management application has Insecure direct object reference IDOR to function “Patient’s Amendments”, and it never bee...

Unauthorized to create and edit Amendments function

Description We would like to report the vulnerability we found during software testing. The OpenEMR 7.0.0 latest version Open Source electronic health records and medical practice management application has unauthorized create and edit on “Patient/dashboard/Amendments” with function...

Reflected Cross Site Scripting in OpenEMR 7.0.0 and below at backup

Description We would like to report the vulnerability we found during software testing. The OpenEMR 7.0.0 latest version and below version Open Source electronic health records and medical practice management application has Reflected Cross Site Scripting vulnerability in the formstatus parameter...

Cross-site Scripting (XSS) - Stored

Description openemr / openemr is vulnerable to Cross-site Scripting XSS - Stored Proof of Concept // Poc alertdocument.cookie steps to reproduce: 1 login open emr patient portal https://demo.openemr.io/openemr/portal/index.php 2 goto my profile in https://demo.openemr.io/openemr/portal/home.php...