2690 matches found
PT-2022-18376 · Openemr · Openemr
Name of the Vulnerable Software and Affected Versions: openemr versions prior to 7.0.0.1 Description: The issue is related to Cross-site Scripting XSS - Reflected. This is a type of security vulnerability that occurs when an application includes user input in its response without properly...
User can do all actives with other's signature (view, get, create, update, delete,...)
Description I observed that users can view any user's signature by changing their user parameter to other's user parameter. By the same way users can create/delete/update other's signature in create signature function. View/Get other's signature: 1. Login to an account I use account receptionist...
Cross-site Scripting - Reflected
Description The pricelevel parameter in openemr is vulnerable to reflected XSS Proof of Concept 1. Open the web browser to access the website 2. Access the url: http://openemr.vn/interface/forms/feesheet/review/feesheetoptionsajax.php?pricelevel=%3Cimg%20src%3da%20onerror%3dalertdocument.cookie%3...
WS-2022-0254
Due to an Improper Access Control in openemr/openemr, all users are able to view any user's signature by changing their user parameter to other's user parameter. In the same way, users can create/delete/update other's signatures in create signature function. An attacker can impersonate to another...
WS-2022-0252
An Insecure direct object references IDOR in openemr/openemr, enables users to delete other users' messages in their Message Center, by changing the deleteid parameter to deleteid value of a message which belongs to another user. As a result, an attacked user will not be able to see messages...
OpenEMR Cross-Site Scripting Vulnerability (CNVD-2022-56131)
OpenEMR is an open source healthcare management system from the Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing applications. openemr versions prior to 7.0.0 have a cross-site scripting vulnerability...
OpenEMR Access Control Error Vulnerability (CNVD-2022-54903)
OpenEMR is an open source healthcare management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing applications. versions of OpenEMR prior to 7.0.0 have an access control error...
OpenEMR < 7.0.0 Multiple Vulnerabilities
OpenEMR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr"; ifdescription...
Idor disclose other user's appointment
Description:- In this case an idor allow an attacker to view portal user's appointments Proof of Concept 1.Goto http://demo.openemr.io/openemr/portal/home.php and then goto my profile my appointment 2.Click on edit appointment button and capture the request in burp suite 3. Change eid parameter t...
OpenEMR < 6.1.0.1 Multiple Vulnerabilities
OpenEMR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr"; ifdescription...
Cross site script
Description In this case a patient is able to execute js scripts in admin's session. further exploitation could lead to admin account takeover Steps to Repro:- 1. Login here https://demo.openemr.io/openemr/portal 2. Goto my documents and create new insurance form 3. Add this payload to any select...
WS-2022-0258
A Cross Site Scripting XSS vulnerability was discovered in openemr/openemr in OnsiteDocumentListView.tpl.php. A patient is able to execute js scripts in admin's session, which may lead to an account takeover. The vulnerability is fixed in version 7.0.0.1...
CVE-2022-2493
Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0...
CVE-2022-2494
Cross-site Scripting XSS - Stored in GitHub repository openemr/openemr prior to 7.0.0...
CVE-2022-2493
Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0...
CVE-2022-2494
Cross-site Scripting XSS - Stored in GitHub repository openemr/openemr prior to 7.0.0...
Cross site scripting
Cross-site Scripting XSS - Stored in GitHub repository openemr/openemr prior to 7.0.0...
CVE-2022-2494
Cross-site Scripting XSS - Stored in GitHub repository openemr/openemr prior to 7.0.0...
