CVE-2026-34053: Missing Authorization

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the AJAX deletion endpoint interface/forms/procedureorder/handledeletions.php allows any authenticated user, regardless of role, to...

EUVD-2019-7372

Malware in sbrugna...

Reflected XSS in interface/forms/eye_mag/js/eye_base.php

Description There exist a reflected XSS in /interface/forms/eyemag/js/eyebase.php in the 'providerID' parameter. Proof of Concept http://openemr.local/interface/forms/eyemag/js/eyebase.php?providerID=%3Cimg%20src=x%20onerror=alert1;%3E fix properly sanitize the providerID parameter...

CVE-2023-22972

A Reflected Cross-site scripting XSS vulnerability in interface/forms/eyemag/php/eyemagfunctions.php in OpenEMR 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUESTURI...

CVE-2023-22973: Improper Limitation of a Pathname to a Restricted Directory

A Local File Inclusion LFI vulnerability in interface/forms/LBF/new.php in OpenEMR 7.0.0 allows remote authenticated users to execute code via the formname parameter...

CVE-2023-22973

A Local File Inclusion LFI vulnerability in interface/forms/LBF/new.php in OpenEMR 7.0.0 allows remote authenticated users to execute code via the formname parameter...

CVE-2021-32104

A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...

PT-2021-19670

Name of the Vulnerable Software and Affected Versions: OpenEMR version 5.0.2.1 Description: A SQL injection issue exists in the interface/forms/eye mag/save.php file, allowing exploitation with user privileges. Recommendations: For OpenEMR version 5.0.2.1, consider restricting access to the...

CVE-2021-32104: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...

Cross site scripting

Reflected XSS exists in interface/forms/eyemag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter...

CVE-2019-16862

Reflected XSS in interface/forms/eyemag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter...

CVE-2019-17409

Reflected XSS exists in interface/forms/eyemag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter...

PT-2019-14837

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.2.1 Description The issue allows a remote attacker to execute arbitrary code in the context of a user's session. This is achieved via the pid parameter in the interface/forms/eye mag/view.php file. Recommendations...

PT-2019-15139

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.2.1 Description A reflected XSS issue exists in the interface/forms/eye mag/view.php file, specifically affecting the id parameter. Recommendations For versions prior to 5.0.2.1, update to version 5.0.2.1 or later...

PT-2019-14661

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.3 Description The issue allows a user to extract arbitrary data from the database via a non-parameterized INSERT INTO statement. This can be achieved by exploiting the providerID parameter in the interface/forms/e...

CVE-2019-16862: Improper Neutralization of Input During Web Page Generation

Reflected XSS in interface/forms/eyemag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter...

CVE-2019-17409: Improper Neutralization of Input During Web Page Generation

Reflected XSS exists in interface/forms/eyemag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter...

CVE-2019-14529

OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eyemag/save.php...

CVE-2019-14529: Improper Neutralization of Special Elements used in an SQL Command

OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eyemag/save.php...

PT-2019-6164

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1 Patch 7 Description The issue is related to the lack of validation of XML object sequences in the make task function of OpenEMR, which can be exploited by a remote attacker to conduct SQL injection attacks. The...