Sql injection

OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinicalrules.php that affects library/patient.inc...

CVE-2019-17197

OpenEMR up to version 5.0.2 is affected by an SQL Injection in the Lifestyle demographic filter criteria within library/clinical_rules.php (affecting library/patient.inc). Root cause: unsafely constructed SQL in the demographic filtering pathway. Impact: potential unauthorized data exposure or mo...

CVE-2019-17197

OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinicalrules.php that affects library/patient.inc...

OpenEMR Path Traversal Vulnerability

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A path traversal vulnerability exists in the 'fileName' parameter of the...

OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-32189)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A cross-site scripting vulnerability exists in OpenEMR 5.0.1-6, which can be exploited by an attacker to execute client-side code...

CVE-2019-8368

OpenEMR v5.0.1-6 allows XSS...

CVE-2019-8368

OpenEMR v5.0.1-6 allows XSS...

Cross site scripting

OpenEMR v5.0.1-6 allows XSS...

CVE-2019-8371

OpenEMR v5.0.1-6 allows code execution...

CVE-2019-8371

OpenEMR v5.0.1-6 allows code execution...

Design/Logic Flaw

OpenEMR v5.0.1-6 allows code execution...

CVE-2019-8368

OpenEMR v5.0.1-6 allows XSS...

CVE-2019-8368

CVE-2019-8368 affects OpenEMR v5.0.1-6 and is a cross-site scripting (XSS) vulnerability. Red Hat/CNVD/OSV listings corroborate the OpenEMR XSS finding. The core issue is a reflected/stored XSS vector in the OpenEMR 5.0.1-6 codebase (exact component/file not specified in the provided documents). ...

CVE-2019-8371

OpenEMR v5.0.1-6 is affected by CVE-2019-8371, which allows code execution. The OpenEMR entry is corroborated across multiple sources (NVD and Red Hat/CNVD-like records) with a CVSSv3.1 base score of 7.2 (HIGH), using a Network attack vector, Low attack complexity, no user interaction, and Privil...

CVE-2019-8371

OpenEMR v5.0.1-6 allows code execution...

OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-28407)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A cross-site scripting vulnerability in the documentid parameter in controller.php in OpenEMR 5.0.1 and earlier versions can be exploited by an attacker to execute arbitrary code in the context of...

OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-28408)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A cross-site scripting vulnerability in the docid parameter in controller.php in OpenEMR 5.0.1 and earlier versions can be exploited by an attacker to execute arbitrary code in the context of a us...

OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-28406)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A cross-site scripting vulnerability in the foreignid parameter in controller.php in OpenEMR 5.0.1 and earlier versions can be exploited by an attacker to execute arbitrary code in the context of ...

OpenEMR Directory Traversal Vulnerability (CNVD-2019-28405)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A directory traversal vulnerability in the patient file download interface in OpenEMR 5.0.1 and earlier versions can be exploited by an authenticated attacker to download arbitrary files from the...

OpenEMR Command Injection Vulnerability (CNVD-2019-28410)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A command injection vulnerability exists in OpenEMR 5.0.1 and earlier versions, which can be exploited by an authenticated attacker to execute arbitrary commands on the host system via the "Scanne...