26 matches found
EUVD-2026-124947
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam eyemag module that allows administrators to inject JavaScript through unencoded Eyedefaults list option titles. Attackers can store a crafted title via editlist.php that breaks out of a jQuery string in...
CVE-2026-126477
OpenEMR before version 8.5.0 is vulnerable to a stored cross-site scripting (XSS) flaw in the Eye Exam (eye_mag) module. The root cause is the failure to encode Eye_defaults list option titles. An administrator can inject JavaScript by storing a crafted title via edit_list.php , which then breaks...
CVE-2019-14529
CVE-2019-14529 Multiple SQL Injection vulnerability in OpenEMR project Vulnerable function in file: /openemr/interface/forms/eyemag/save.php Conditions : any authorized user Vulnerable versions: 5.0.2, Fixed in 5.0.2 version. Description There are two functions: 1. "storePDF", with non filtered...
CVE-2026-124452
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...
CVE-2026-124452 OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...
CVE-2026-124452
OpenEMR versions prior to 8.3.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability located in interface/forms/eye_mag/report.php. The root cause is the application's failure to escape document notes, allowing authenticated users with write access to inject malicious JavaScript in...
CVE-2026-124452 OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...
EUVD-2026-119510
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...
CVE-2026-124452: openemr: OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that…
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...
CVE-2026-27943
OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the eye exam eyemag view loads data by "formid" or equivalent without verifying that the form belongs to the current user’s patient/encounter context. An...
CVE-2026-27943: Authorization Bypass Through User-Controlled Key
OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the eye exam eyemag view loads data by formid or equivalent without verifying that the form belongs to the current user’s patient/encounter context. An...
EUVD-2019-5699
Malware in sbrugna...
EUVD-2018-8953
Malware in sbrugna...
CVE-2021-32104
A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...
CVE-2023-22972
A Reflected Cross-site scripting XSS vulnerability in interface/forms/eyemag/php/eyemagfunctions.php in OpenEMR 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUESTURI...
CVE-2021-32104
A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...
CVE-2021-32104: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...
Cross site scripting
Reflected XSS exists in interface/forms/eyemag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter...