11 matches found
CVE-2026-126448
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nnconfigure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajaxcode.php or addcontext.php, which lack ACL and CSR...
CVE-2026-126448 OpenEMR before 8.5.0 Missing Authorization in Nation Notes Configuration Handlers
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nnconfigure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajaxcode.php or addcontext.php, which lack ACL and CSR...
EUVD-2026-124986
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nnconfigure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajaxcode.php or addcontext.php, which lack ACL and CSR...
CVE-2026-126448
OpenEMR versions before 8.5.0 are vulnerable to a missing authorization flaw within the Nation Notes configuration handlers. The root cause is the lack of ACL and CSRF checks on the ajax_code.php and add_context.php endpoints. This allows authenticated users without the nationnotes/nn_configure p...
EUVD-2021-18961
Malware in sbrugna...
CVE-2021-32102
A SQL injection vulnerability exists with user privileges in library/customtemplate/ajaxcode.php in OpenEMR 5.0.2.1...
CVE-2021-32102
A SQL injection vulnerability exists with user privileges in library/customtemplate/ajaxcode.php in OpenEMR 5.0.2.1...
CVE-2021-32102
A SQL injection vulnerability exists with user privileges in library/customtemplate/ajaxcode.php in OpenEMR 5.0.2.1...
CVE-2021-32102
A SQL injection vulnerability exists with user privileges in library/customtemplate/ajaxcode.php in OpenEMR 5.0.2.1...
CVE-2021-32102
A SQL injection vulnerability exists with user privileges in library/customtemplate/ajaxcode.php in OpenEMR 5.0.2.1...
CVE-2021-32102: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists with user privileges in library/customtemplate/ajaxcode.php in OpenEMR 5.0.2.1...