CVE-2021-32101

The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/machineconfig.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulat...

CVE-2021-32102

A SQL injection vulnerability exists with user privileges in library/customtemplate/ajaxcode.php in OpenEMR 5.0.2.1...

CVE-2021-32102

OpenEMR 5.0.2.1 is affected by a SQL injection in library/custom_template/ajax_code.php. Reported as CVE-2021-32102 with user-privilege access and network access (CVSS v3.1: 8.8; CVSS v2: 6.5). Multiple sources (NVD, Red Hat, CNVD, OSV, CVE.org, CNNVD) corroborate the issue in the same component....

CVE-2021-32103

A Stored XSS vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter...

CVE-2021-32103

OpenEMR CVE-2021-32103 is a Stored XSS affecting the interface/usergroup/usergroup_admin.php path in OpenEMR versions prior to 5.0.2.1. An admin-authenticated user could inject arbitrary script/HTML via the lname parameter. The vulnerability arises from improper handling of input in the admin use...

CVE-2021-32104

A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...

CVE-2021-32104

The CVE-2021-32104 entry concerns OpenEMR 5.0.2.1 where a SQL injection vulnerability exists in interface/forms/eye_mag/save.php, with the root cause being unsanitized user input leading to injection. The exploitation field is not detailed in the provided documents, but the weakness is described ...

OpenEMR 安全漏洞

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. An access control error vulnerability exists in OpenEMR version 5.0.2.1, which ste...

OpenEMR SQL注入漏洞

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A SQL injection vulnerability exists in interface/forms/eyemag/save.php in OpenEMR version 5.0.2.1. No details of the vulnerability are provided at this time...

OpenEMR 跨站脚本漏洞

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A stored cross-site scripting vulnerability exists in interface/usergroup/usergroupadmin.php in OpenEMR versions prior to 5.0.2.1. An attacker can exploit this vulnerability to inject arbitrary we...

OpenEMR SQL注入漏洞

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A SQL injection vulnerability exists in library/customtemplate/ajaxcode.php in OpenEMR version 5.0.2.1. No detailed vulnerability details are provided at this time...

OpenEMR 5.0.2.1 - Remote Code Execution Exploit

Exploit Title: OpenEMR 5.0.2.1 - Remote Code Execution Exploit Author: Hato0, BvThTrd Vendor Homepage: https://www.open-emr.org/ Software Link: https://sourceforge.net/projects/openemr/files/OpenEMR%20Current/5.0.2.1/openemr-5.0.2.tar.gz/download Version: 5.0.2.1 without patches Tested on: Ubuntu...

OpenEMR 5.0.2.1 - Remote Code Execution

Exploit Title: OpenEMR 5.0.2.1 - Remote Code Execution Exploit Author: Hato0, BvThTrd Date: 2020-08-07 Vendor Homepage: https://www.open-emr.org/ Software Link: https://sourceforge.net/projects/openemr/files/OpenEMR%20Current/5.0.2.1/openemr-5.0.2.tar.gz/download Version: 5.0.2.1 without patches...

OpenEMR 5.0.2.1 Remote Code Execution

Exploit Title: OpenEMR 5.0.2.1 - Remote Code Execution Exploit Author: Hato0, BvThTrd Date: 2020-08-07 Vendor Homepage: https://www.open-emr.org/ Software Link: https://sourceforge.net/projects/openemr/files/OpenEMR%20Current/5.0.2.1/openemr-5.0.2.tar.gz/download Version: 5.0.2.1 without patches...

OpenEMR 4.1.0 SQL Injection

Exploit Title: OpenEMR 4.1.0 - 'u' SQL Injection Date: 2021-04-03 Exploit Author: Michael Ikua Vendor Homepage: https://www.open-emr.org/ Software Link: https://github.com/openemr/openemr/archive/refs/tags/v410.zip Version: 4.1.0 Original Advisory:...

OpenEMR 4.1.0 - (u) SQL Injection Exploit

Exploit Title: OpenEMR 4.1.0 - 'u' SQL Injection Exploit Author: Michael Ikua Vendor Homepage: https://www.open-emr.org/ Software Link: https://github.com/openemr/openemr/archive/refs/tags/v410.zip Version: 4.1.0 Original Advisory:...

OpenEMR 4.1.0 - 'u' SQL Injection

Exploit Title: OpenEMR 4.1.0 - 'u' SQL Injection Date: 2021-04-03 Exploit Author: Michael Ikua Vendor Homepage: https://www.open-emr.org/ Software Link: https://github.com/openemr/openemr/archive/refs/tags/v410.zip Version: 4.1.0 Original Advisory:...

OpenEMR 2.7.3-rc1 < 6.0.0.1 XSS Vulnerability

OpenEMR is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr";...

OpenEMR 4.2.0 < 6.0.0.1 XSS Vulnerability

OpenEMR is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr";...

OpenEMR 5.0.2 < 6.0.0.1 Multiple XSS Vulnerabilities

OpenEMR is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...