32 matches found
CVE-2026-126434
OpenEMR versions prior to 8.5.0 are vulnerable to a missing authorization flaw in interface/forms/procedure_order/common.php. This vulnerability allows authenticated accounts that lack specific patients/lab permissions to access and manipulate procedure orders belonging to other patients. Specifi...
CVE-2026-124452
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...
CVE-2026-124452 OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...
CVE-2026-124452
OpenEMR versions prior to 8.3.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability located in interface/forms/eye_mag/report.php. The root cause is the application's failure to escape document notes, allowing authenticated users with write access to inject malicious JavaScript in...
CVE-2026-124452 OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...
EUVD-2026-119510
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...
CVE-2026-124452: openemr: OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that…
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...
PT-2026-139968
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye mag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...
CVE-2026-103935
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfersummary/new.php and interface/forms/functionalcognitivestatus/new.php render stored transferto, code, and codetext values with text, which uses...
CVE-2026-103935 OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfersummary/new.php and interface/forms/functionalcognitivestatus/new.php render stored transferto, code, and codetext values with text, which uses...
CVE-2026-34053: Missing Authorization
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the AJAX deletion endpoint interface/forms/procedureorder/handledeletions.php allows any authenticated user, regardless of role, to...
EUVD-2019-7372
Malware in sbrugna...
Reflected XSS in interface/forms/eye_mag/js/eye_base.php
Description There exist a reflected XSS in /interface/forms/eyemag/js/eyebase.php in the 'providerID' parameter. Proof of Concept http://openemr.local/interface/forms/eyemag/js/eyebase.php?providerID=%3Cimg%20src=x%20onerror=alert1;%3E fix properly sanitize the providerID parameter...
CVE-2023-22973: Improper Limitation of a Pathname to a Restricted Directory
A Local File Inclusion LFI vulnerability in interface/forms/LBF/new.php in OpenEMR 7.0.0 allows remote authenticated users to execute code via the formname parameter...
CVE-2023-22972
A Reflected Cross-site scripting XSS vulnerability in interface/forms/eyemag/php/eyemagfunctions.php in OpenEMR 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUESTURI...
CVE-2023-22973
A Local File Inclusion LFI vulnerability in interface/forms/LBF/new.php in OpenEMR 7.0.0 allows remote authenticated users to execute code via the formname parameter...
CVE-2021-32104
A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...
CVE-2021-32104: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...
PT-2021-19670
Name of the Vulnerable Software and Affected Versions: OpenEMR version 5.0.2.1 Description: A SQL injection issue exists in the interface/forms/eye mag/save.php file, allowing exploitation with user privileges. Recommendations: For OpenEMR version 5.0.2.1, consider restricting access to the...
