Code injection

The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/machineconfig.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulat...

CVE-2021-32103

A Stored XSS vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter...

CVE-2021-32102

A SQL injection vulnerability exists with user privileges in library/customtemplate/ajaxcode.php in OpenEMR 5.0.2.1...

CVE-2021-32101

The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/machineconfig.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulat...

CVE-2021-32104

A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...

CVE-2021-32101

The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/machineconfig.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulat...

CVE-2021-32101

The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/machineconfig.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulat...

CVE-2021-32101

The CVE-2021-32101 entry concerns OpenEMR 5.0.2.1’s Patient Portal, where an incorrect access control in portal/patient/_machine_config.php allows an unauthenticated attacker to register an account and bypass the portal API’s permission checks, enabling manipulation and reading of data for any re...

CVE-2021-32102

A SQL injection vulnerability exists with user privileges in library/customtemplate/ajaxcode.php in OpenEMR 5.0.2.1...

CVE-2021-32102

OpenEMR 5.0.2.1 is affected by a SQL injection in library/custom_template/ajax_code.php. Reported as CVE-2021-32102 with user-privilege access and network access (CVSS v3.1: 8.8; CVSS v2: 6.5). Multiple sources (NVD, Red Hat, CNVD, OSV, CVE.org, CNNVD) corroborate the issue in the same component....

CVE-2021-32102

A SQL injection vulnerability exists with user privileges in library/customtemplate/ajaxcode.php in OpenEMR 5.0.2.1...

CVE-2021-32103

A Stored XSS vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter...

CVE-2021-32103

A Stored XSS vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter...

CVE-2021-32103

OpenEMR CVE-2021-32103 is a Stored XSS affecting the interface/usergroup/usergroup_admin.php path in OpenEMR versions prior to 5.0.2.1. An admin-authenticated user could inject arbitrary script/HTML via the lname parameter. The vulnerability arises from improper handling of input in the admin use...

CVE-2021-32104

A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...

CVE-2021-32104

A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...

CVE-2021-32104

The CVE-2021-32104 entry concerns OpenEMR 5.0.2.1 where a SQL injection vulnerability exists in interface/forms/eye_mag/save.php, with the root cause being unsanitized user input leading to injection. The exploitation field is not detailed in the provided documents, but the weakness is described ...

PT-2021-19668

Name of the Vulnerable Software and Affected Versions: OpenEMR version 5.0.2.1 Description: A SQL injection issue exists in the library/custom template/ajax code.php file, allowing exploitation with user privileges. Recommendations: For OpenEMR version 5.0.2.1, consider restricting access to the...

CVE-2021-32102: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists with user privileges in library/customtemplate/ajaxcode.php in OpenEMR 5.0.2.1...

CVE-2021-32101: Incorrect Permission Assignment for Critical Resource

The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/machineconfig.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulat...