CVE-2020-29143

CVE-2020-29143 describes a SQL injection in OpenEMR’s interface/reports/non_reported.php, exploitable via the form_code parameter. The vulnerability affects OpenEMR prior to 5.0.2.5 and can be triggered by an authenticated remote attacker who can supply crafted input, leading to arbitrary SQL exe...

CVE-2020-29143

A SQL injection vulnerability in interface/reports/nonreported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the formcode parameter...

CVE-2020-29139

A SQL injection vulnerability in interface/main/finder/patientselect.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the searchFields parameter...

CVE-2020-29139

A SQL injection vulnerability in interface/main/finder/patientselect.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the searchFields parameter...

CVE-2020-29139

OpenEMR prior to 5.0.2.5 is affected by a SQL injection in interface/main/finder/patient_select.php (via library/patient.inc) where the searchFields parameter enables remote authenticated attackers to execute arbitrary SQL. This is the concrete vulnerability: the input field is used in a query wi...

CVE-2020-29140

A SQL injection vulnerability in interface/reports/immunizationreport.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the formcode parameter...

CVE-2020-29140

A SQL injection vulnerability in interface/reports/immunizationreport.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the formcode parameter...

CVE-2020-29140

OpenEMR is affected by CVE-2020-29140: a SQL injection in interface/reports/immunization_report.php susceptible to exploitation by a remote authenticated attacker via the form_code parameter. The issue affects OpenEMR prior to version 5.0.2.5. The vulnerability is due to improper handling of user...

CVE-2020-29142

A SQL injection vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedulefacility parameter when restrictuserfacility=on is in global settings...

CVE-2020-29142

A SQL injection vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedulefacility parameter when restrictuserfacility=on is in global settings...

Sql injection

A SQL injection vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedulefacility parameter when restrictuserfacility=on is in global settings...

CVE-2020-29142

A SQL injection vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedulefacility parameter when restrictuserfacility=on is in global settings...

CVE-2020-29142

A SQL injection vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedulefacility parameter when restrictuserfacility=on is in global settings...

CVE-2020-29142

OpenEMR contains a SQL injection in interface/usergroup/usergroup_admin.php (CVE-2020-29142). The flaw allows a remote, authenticated attacker to execute arbitrary SQL commands via the schedule_facility parameter when global setting restrict_user_facility is on, affecting OpenEMR versions before ...

PT-2021-11647

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.2.5 Description: A SQL injection issue allows a remote authenticated attacker to execute arbitrary SQL commands. The issue is related to the form code parameter in the interface/reports/non reported.php file...

CVE-2020-29140: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in interface/reports/immunizationreport.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the formcode parameter...

CVE-2020-29143: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in interface/reports/nonreported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the formcode parameter...

PT-2021-11645

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.2.5 Description: A SQL injection issue allows a remote authenticated attacker to execute arbitrary SQL commands. The issue is related to the form code parameter in the interface/reports/immunization report.php...

PT-2021-11646

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.2.5 Description: A SQL injection issue allows a remote authenticated attacker to execute arbitrary SQL commands via the schedule facility parameter when restrict user facility=on is in global settings. This occur...

OpenEMR SQL注入漏洞

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A SQL injection vulnerability exists in interface/main/finder/patientselect.php in OpenEMR versions prior to 5.0.2.5. A remote authenticated attacker can exploit this vulnerability to execute...