Sql injection

An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php...

Sql injection

An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the maketask function in /interface/forms/eyemag/php/taskmanfunctions.php via /interface/forms/eyemag/taskman.php...

CVE-2018-17179

An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the maketask function in /interface/forms/eyemag/php/taskmanfunctions.php via /interface/forms/eyemag/taskman.php...

CVE-2018-17181

An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php...

CVE-2018-17181

OpenEMR before 5.0.1 Patch 7 contains SQL injection vulnerabilities in the SaveAudit function (/portal/lib/paylib.php) and the portalAudit function (/portal/lib/appsql.class.php). These flaws allow unauthenticated network access to potentially manipulate the database, with high/severe impact per ...

CVE-2018-17181

An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php...

CVE-2018-17180

An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/downloadtemplate.php...

CVE-2018-17180

OpenEMR up to version 5.0.1 Patch 7 is affected by a Directory Traversal vulnerability in the portal/lib/download_template.php via docid=../, exposing partial confidentiality. Root cause is improper path handling allowing traversal to access restricted files. A patch exists in 5.0.1 Patch 7 (and ...

CVE-2018-17179

OpenEMR prior to 5.0.1 Patch 7 contains a SQL injection in the make_task function under /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php. The issue affects OpenEMR 5.0.1 Patch 7 and earlier. Root cause is improper input handling enabling SQLi, with CVSS ...

CVE-2018-17179

An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the maketask function in /interface/forms/eyemag/php/taskmanfunctions.php via /interface/forms/eyemag/taskman.php...

OpenEMR < 5.0.1 Patch 6 XSS Vulnerability

A vulnerability in flashcanvas.swf in OpenEMR could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by th...

OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-14077)

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security vulnerability exists in the flashcanvas.swf file in versions of OpenEMR...

Cross site scripting

A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system...

CVE-2018-18035

A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system...

CVE-2018-18035

A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system...

CVE-2018-18035

CVE-2018-18035 describes an unauthenticated, remote XSS in the OpenEMR flashcanvas.swf component. The affected software is OpenEMR prior to 5.0.1 Patch 6. The vulnerability arises from an XSS in flashcanvas.swf that could be exploited by an attacker targeting a system using OpenEMR with this vers...

CVE-2018-18035

A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system...

LibreHealth 2.0.0 File Read / File Delete / LFI

Exploit Title: LibreHealth 2.0.0 - Arbitrary File Actions Date: 2018-10-19 Exploit Author: Carlos Avila Vendor Homepage: https://librehealth.io/ Software Link: https://github.com/LibreHealthIO/lh-ehr Version: 2.0.0 Tested on: Debian LAMP, LibreHealth 2.0.0 LibreHealth is the 'fork' of the OpenEMR...

OpenEMR <= 5.0.1.4 XSS Vulnerabilities

OpenEMR is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross site scripting

OpenEMR version v5014 contains a Cross Site Scripting XSS vulnerability in The 'file' parameter in line 43 of interface/fax/faxview.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack appear to be exploitable via...